by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's code and instructions match its stated purpose (controlling Xiaomi devices via Home Assistant) but several inconsistencies — notably missing declared environment variables, a hard-coded local HA URL default, and a reference to an external TOOLS.md — mean you should review or correct configuration before trusting it with your Home Assistant token.
评估建议
This skill appears to do what it claims (call Home Assistant services for Xiaomi devices), but take these precautions before installing:
- Expect to provide an HA access token (HA_TOKEN) and optionally HA_URL; the skill metadata fails to declare these — verify with the author and prefer a skill that lists required credentials explicitly.
- The SKILL.md defaults HA_URL to a specific local IP (http://192.168.31.35:8123) — change that to your HA instance or remove the default to avoid accidental c...详细分析 ▾
ℹ 用途与能力
The skill's name, description, SKILL.md, and the included Python script all describe Home Assistant control and the included entity IDs align with that purpose. However, the registry metadata declares no required environment variables or primary credential even though both the SKILL.md and script expect an HA access token (HA_TOKEN) and optionally HA_URL; this mismatch is unexpected and should be corrected.
ℹ 指令范围
Runtime instructions and the script only call the user's Home Assistant API endpoints to trigger services (curl examples and a Python helper). They do not reference external network endpoints beyond the HA_URL. Concern: SKILL.md tells the agent to 'Load configuration from TOOLS.md → 智能家居' but TOOLS.md is not included or referenced in metadata — that is an ambiguous external dependency and could allow unintended config lookups.
✓ 安装机制
There is no install spec (instruction-only + small script included). The Python script is small, readable, and uses standard libraries (urllib). No downloads or archive extraction occur. This is low-install risk.
⚠ 凭证需求
The skill needs sensitive credentials (HA access token) and optionally a HA_URL, but the registry metadata lists no required env vars or primary credential. The SKILL.md and script expect HA_TOKEN (and use HA_URL, defaulting to a specific local IP). Requiring a token is proportionate to the task, but failing to declare it is a configuration omission that could confuse users and lead to accidental exposure or misconfiguration.
✓ 持久化与权限
The skill does not request permanent presence (always=false), does not modify other skills or system config, and does not persist credentials itself. Autonomous invocation is allowed (platform default) but this is not combined with other high-privilege requests.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv0.1.02026/3/10
ha-xiaomi-control v0.1.0 – Initial Release - Introduces Xiaomi smart home device control via Home Assistant API. - Supports command-based control for Xiao AI speakers and air conditioners. - Provides entity and service mappings for controlling power, temperature, and modes. - Includes detailed API examples for each supported action. - Adds troubleshooting and security guidance for setup and operation.
● 无害
安装命令
点击复制官方npx clawhub@latest install haxiaomicontrol
镜像加速npx clawhub@latest install haxiaomicontrol --registry https://cn.longxiaskill.com