Xiaomi Miot

小米米家智能家居控制技能。通过小爱音箱、米家设备控制灯光、空调、扫地机器人等小米IoT设备。当用户说"开灯"、"关空调"、"让扫地机器人扫地"等智能家居控制指令时使用。

This skill appears to implement the described Xiaomi login and device-control flow and uses Feishu to present login cards — that part is coherent. However, the code contains a hard-coded Xiaomi client_secret in login_card.py that contradicts the SKILL.md guidance to pass secrets via environment variables. Before installing or using this skill: - Do not reuse production secrets. Create and use dedicated test FEISHU and Xiaomi OAuth credentials so you can revoke them if needed. - Ask the author to remove the hard-coded client_secret and rely solely on the XIAOMI_CLIENT_SECRET env var (or confirm why the hard-coded value is present). Hard-coded secrets may indicate sloppy engineering or a leaked/stale credential. - Inspect (or request) the full code beyond the truncated portion to confirm there are no additional unexpected network endpoints or data exfiltration. - Verify the token cache path (~/.openclaw/skills/xiaomi-miot/data/token_cache.json) is acceptable for your threat model and ensure filesystem permissions are strict (owner-only). If the author cannot justify or remove the embedded client_secret, treat this as a significant red flag and avoid installing it in production environments.

Type: OpenClaw Skill Name: xiaomi-miot-lan Version: 1.4.0 The skill implements Xiaomi Mi Home integration but exhibits high-risk security practices. Most notably, SKILL.md instructs the AI agent to collect the user's Xiaomi password in plain text via the chat interface, exposing it to the LLM and the platform. Additionally, the skill stores sensitive authentication tokens in a local file (~/.openclaw/skills/xiaomi-miot/data/token_cache.json) and uses a hardcoded OAuth client secret in login_card.py. While these behaviors represent significant security vulnerabilities regarding credential handling, there is no clear evidence of intentional data exfiltration to unauthorized third-party domains beyond the official Xiaomi and Feishu endpoints.