Venus BLE Vibrator

Control a Venus (Cachito) BLE vibrator from natural language. Calls a local HTTP server that broadcasts BLE commands to the toy via macOS CoreBluetooth. Requ...

Security Scan

The skill's requirements and runtime instructions are consistent with its stated purpose: it issues local HTTP (curl) commands to a user-run macOS BLE bridge; it does not request unrelated credentials or install remote code.

Purpose & Capability

Name/description match the instructions: the skill sends curl POST/GET requests to a local ToyBridge HTTP server that broadcasts BLE commands to a Venus/Cachito toy on macOS. It does not request unrelated services or credentials.

Instruction Scope

SKILL.md only instructs the agent to call local endpoints (host.docker.internal or localhost) on port 8888 using curl and to follow the ToyBridge setup guide. It does not instruct the agent to read arbitrary host files or exfiltrate data. The only file references are to the ToyBridge repo the user is told to install separately.

Install Mechanism

Instruction-only skill with no install spec and no code files—nothing is downloaded or written by the skill itself, which minimizes install risk.

Credentials

No environment variables, secrets, or credentials are requested. The skill relies on a locally run server and macOS Bluetooth permissions, which are proportionate to the stated purpose.

Persistence & Privilege

The skill is not always-enabled and uses normal autonomous invocation defaults. It does not request persistent system-wide privileges or modify other skills' configurations.

Assessment

This appears coherent, but consider these practical safety steps before installing: - Only run the ToyBridge server from a source you trust (review the referenced GitHub repo) because the server code you run locally will control the device. - Ensure the bridge listens only on localhost (do not expose port 8888 to your network) so remote parties cannot control the toy. - Confirm the exact command the skill expects (the SKILL.md uses `uv run 4-bridge/server.py` which may be nonstandard); verify and run the server manually yourself before letting the agent call it. - The agent will execute shell curl commands; if you enable autonomous invocation, be comfortable with the agent making local HTTP calls and issuing shell commands. Consider restricting agent permissions or disabling autonomous runs if you prefer manual confirmation. - Be mindful of privacy and consent: device control is sensitive. Make sure all device owners consent to remote or automated control.

Venus BLE Vibrator Control

Control a Venus / Cachito (小猫爪) BLE vibrator using natural language through OpenClaw.

This is a device-specific skill for Cachito-protocol toys. If your device is supported by Buttplug.io, use the intiface-control skill instead — no reverse-engineering needed.

macOS only. The server uses CoreBluetooth.

---

Setup

Follow the ToyBridge setup guide — complete Steps 1–3 (discover device ID, configure, verify locally), then start the server:

uv run 4-bridge/server.py

Leave this terminal open. The server runs on port 8888.

---

Commands the agent will use

Vibrate at intensity

curl -s -X POST http://host.docker.internal:8888/vibrate \
  -H "Content-Type: application/json" \
  -d '{"intensity": 60}'

intensity: 0–100 (0 = stop)

Stop immediately

curl -s -X POST http://host.docker.internal:8888/stop

Check status

curl -s http://host.docker.internal:8888/status

If OpenClaw runs natively (not in Docker), replace host.docker.internal with localhost.

---

Intensity guide

Range	Feel
1–20	Gentle
30–50	Medium
60–80	Strong
90–100	Maximum

---

Preset patterns

Pattern	What it does
pulse	Bursts of 80%, 5 times
wave	Ramp up 20→100%, then back down, x2
tease	30% → 70% → 100%, escalating, then stop

Example: "Run the wave pattern" or "Give me a 30-second tease session"

---

Agent rules

• Always stop (intensity 0) after a timed session unless user says to keep going
• Do not use the notify tool — use bash with curl
• Replace host.docker.internal with localhost if OpenClaw is not in Docker

---

Troubleshooting

Problem	Fix
BT not ready error	Check Bluetooth is on, grant permission in System Settings → Privacy
connection refused	Make sure uv run 4-bridge/server.py is running
Device doesn't respond	Double-check DEVICE_ID in 4-bridge/ble_worker.py matches your Cachito controller
Wrong intensity	Values are clamped to 0–100