by 下载技能包
最后更新
2026/4/21
安全扫描
OpenClaw
可疑
medium confidenceThe skill appears to implement Xiaomi cloud control as advertised, but it includes many hard-coded, personal device/home identifiers and writes/reads local credential/state files — this mismatch (generic controller vs. a bundle tailored to one household) is concerning and worth review before installing.
评估建议
Before installing or running this skill, consider the following:
- This package appears to be customized for a specific home: it includes hard-coded device IDs and a home_id. If you do not own those devices, do not use the pre-filled references — remove or replace them with your own device IDs.
- The skill requires Xiaomi cloud credentials saved to ~/.mijia_creds.json (serviceToken, ssecurity, userId). Only create that file if you trust the code; protect it (chmod 600) and do not share it. Prefe...详细分析 ▾
ℹ 用途与能力
The code and instructions implement Mi Home cloud control (uses micloud, calls MiCloud APIs, provides get/set/scene/tts/batch actions) which matches the skill description. However the repository contains a device registry and home_id hard-coded for a specific household (labels like 'BOSS home', many DIDs, home_id=159001331072). That makes the package appear tailored to a particular user's environment rather than a generic, reusable controller.
ℹ 指令范围
Runtime instructions and scripts operate within the Xiaomi API domain and the user's home directory: they read/write ~/.mijia_creds.json, cache devices to ~/.mijia_devices.json, and maintain ~/.fish_feed_state.json. They also instruct manual browser-based login steps. Instructions do not attempt to read unrelated system files or call unexpected external endpoints, but they do require storing sensitive credentials locally and will poll cloud device event logs (expected for this functionality).
✓ 安装机制
There is no automated install/download step; this is instruction-plus-source included in the bundle. The only external install required is the micloud Python package (pip3 install micloud), which is a normal dependency for this functionality. No remote arbitrary archives or URL downloads are used.
⚠ 凭证需求
No environment variables are requested, and the credential storage (~/.mijia_creds.json) is proportionate for a cloud API client. However the bundle embeds many device IDs, models, and a home_id specific to one household. Those entries are sensitive (device identifiers and home_id) and are not required for a generic controller; their presence is disproportionate and may leak another person's home layout or identifiers if this package is shared or published.
✓ 持久化与权限
The skill does not request 'always: true' and does not modify other skills or system-wide agent settings. It writes only to files within the user's home (~/.mijia_creds.json, ~/.mijia_devices.json, ~/.fish_feed_state.json) which is expected for caching/credential/state; autonomous invocation is allowed (platform default) but not an additional privilege requested by the skill.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.1.02026/3/20
Add auto fish feeding (poll door lock events + daily dedup); fix action param format for fish feeder; add TTS command for XiaoAI speaker
● 无害
安装命令
点击复制官方npx clawhub@latest install mijia-control
镜像加速npx clawhub@latest install mijia-control --registry https://cn.longxiaskill.com