首页 › 龙虾技能列表 › Xiaomi Miot — 实用工具

Xiaomi Miot — 实用工具

v1.4.0

Xiaomi Miot是一款实用的工具技能，能够帮助用户完成相关任务，提升工作效率。

2· 87·0 当前·0 累计
by @lanlan314 (woodylan)·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/1
安全扫描
VirusTotal
可疑
查看报告
OpenClaw
可疑
medium confidence
The skill's declared purpose and most behavior line up with a Xiaomi IoT login/control flow, but the code contains a hard-coded Xiaomi client_secret and inconsistent secret handling that contradicts the SKILL.md guidance — this is unexpected and worth caution.
评估建议
This skill appears to implement the described Xiaomi login and device-control flow and uses Feishu to present login cards — that part is coherent. However, the code contains a hard-coded Xiaomi client_secret in login_card.py that contradicts the SKILL.md guidance to pass secrets via environment variables. Before installing or using this skill: - Do not reuse production secrets. Create and use dedicated test FEISHU and Xiaomi OAuth credentials so you can revoke them if needed. - Ask the author...
详细分析 ▾
ℹ 用途与能力
Name/description (Xiaomi Miot device control) match the code and instructions: the skill implements login, token caching, and device list retrieval via Xiaomi APIs and uses Feishu to present interactive login cards. Requesting FEISHU_APP_ID/FEISHU_APP_SECRET (to send cards) and Xiaomi OAuth client id/secret is consistent with the described flow. However, one code file (login_card.py) hard-codes a Xiaomi client_secret value rather than using the declared environment variable, which contradicts the SKILL.md statement that secrets are passed via env vars.
✓ 指令范围
SKILL.md describes a login flow, token caching path (~/.openclaw/skills/xiaomi-miot/data/token_cache.json), and the need to provide FEISHU and Xiaomi credentials. The runtime instructions and the code operate within that stated scope: they request credentials, prompt for captcha when needed, call Xiaomi APIs, and use Feishu APIs to show/update cards. The skill stores tokens locally in the declared cache path. There is no instruction or code that accesses unrelated system paths or sends data to third-party endpoints other than Xiaomi and Feishu.
✓ 安装机制
No install spec (instruction-only) and a small requirements.txt with 'requests' only. This is a low-risk install pattern and consistent with an instruction-only Python skill.
⚠ 凭证需求
Requested environment variables (XIAOMI_CLIENT_ID/SECRET and FEISHU_APP_ID/SECRET) are appropriate for the listed capabilities. However, login_card.py contains a hard-coded Xiaomi client_secret string used in OAuth token calls, contradicting the SKILL.md claim '敏感信息通过环境变量传递，不硬编码在代码中'. This discrepancy is a meaningful inconsistency: either the code will ignore the provided CLIENT_SECRET env var (leading to unexpected behavior), or the author accidentally embedded a secret. Hard-coded client secrets are a risk because they may leak or be reused incorrectly.
✓ 持久化与权限
The skill does persist the OAuth token to ~/.openclaw/skills/xiaomi-miot/data/token_cache.json as described in SKILL.md; this is expected for an integration that needs reusable tokens. The skill is not marked always:true and does not request system-wide privileges or alter other skills' configs.
安全有层次，运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发，无需署名。

运行时依赖

无特殊依赖

版本

latestv1.4.02026/3/31

修复 bug：多处 resp.json() 未处理 &&&START&&& 前缀导致 JSON 解析失败；优化登录流程

● 可疑

安装命令 点击复制

官方npx clawhub@latest install xiaomi-miot-lan
镜像加速npx clawhub@latest install xiaomi-miot-lan --registry https://cn.clawhub-mirror.com

技能文档

🎯 功能

  • ✅ 获取用户所有米家设备列表
  • ✅ 控制设备：开/关、调节亮度、温度等
  • ✅ 触发场景（如"离家模式"、"睡眠模式"）
  • ✅ 查询设备状态

🔧 必需的环境变量

1. 小米 OAuth2 凭证

export XIAOMI_CLIENT_ID="2882303761517424859"        # 小米客户端 ID
export XIAOMI_CLIENT_SECRET="你的客户端密钥"           # 小米客户端密钥

2. 飞书应用凭证（用于发送登录卡片）

export FEISHU_APP_ID="你的飞书应用ID"
export FEISHU_APP_SECRET="你的飞书应用密钥"
⚠️ 重要：建议使用自己的飞书应用凭证，而非硬编码默认值。

📱 全平台兼容登录流程

本 skill 采用纯文字交互，支持所有平台：

  • 飞书、企业微信、钉钉
  • OpenClaw 网页端、终端 CLI

登录步骤

用户: 帮我登录小米
  ↓
小蓝: 📱 请输入小米账号手机号：
  ↓
用户: 15393120163
  ↓
小蓝: 🔒 请输入密码：
  ↓
用户: ●●●●●●●●●●
  ↓
小蓝: 🔄 正在验证...
  ↓
如果需要验证码：
  小蓝: 📱 请输入验证码：fkqdx
  用户: fkqdx
  ↓
小蓝: ✅ 登录成功！找到 3 个设备：
       • 小米路由器4A 🟢
       • 小爱音箱 🔴
       • 小爱音箱play 🔴
💡 Token 有效期 30 天，之后自动提示重新登录

🔐 安全说明

  • 令牌 存储：macaroon 令牌 缓存至 ~/.openclaw/skills/xiaomi-miot/data/token_cache.json
  • 凭证管理：敏感信息通过环境变量传递，不硬编码在代码中
  • 文件权限：确保 ~/.openclaw 目录权限安全（600 或 700）

⚠️ 注意事项

  • 验证码是必须的 — 小米安全机制要求新设备验证
  • 设备离线时无法控制 — 需确保设备在线
  • 限流机制 — 频繁登录可能触发临时限制

🚀 安装

openclaw skills install xiaomi-miot-lan

安装后请配置上述环境变量。

数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制

了解定制服务