Xtoys.app Webhook Controller

Control xtoys.app devices via webhook. Supports precise control of various body parts for remote intimate device control.

This skill appears to do what it claims: read a webhook ID (from argument, env var, or config file) and send GET requests to webhook.xtoys.app with action and level. Before installing: 1) Verify the webhook domain and project source (source is listed as unknown — consider checking the GitHub repo linked in README to confirm authenticity). 2) Keep your XTOYS_WEBHOOK_ID private (anyone with it can control devices). 3) Note the script will look for config.json in ~/.config and /etc — ensure those files do not contain sensitive data you don't want read. 4) If you distrust network activity, restrict the skill's network access or test in a controlled environment. 5) Use low intensity and safeword/testing when exercising remote-control features.

Type: OpenClaw Skill Name: xtoys-app Version: 1.1.2 The skill is a legitimate implementation for controlling devices via the xtoys.app webhook API. The core logic in `scripts/xtoys_control.py` uses standard Python libraries to send GET requests to the official xtoys.app domain, with proper input validation for intensity levels and actions. No evidence of data exfiltration, malicious command execution, or prompt injection was found; the handling of the Webhook ID via environment variables and local configuration files follows standard security practices for API-based tools.