SwitchBot Smart Home Control

Control SwitchBot smart home devices (curtains, plugs, lights, locks, etc.) via SwitchBot Cloud API. Use when user asks to open/close curtains, turn on/off lights/plugs, check temperature/humidity, or control any SwitchBot device.

Security Scan

The skill's code and runtime instructions match its stated purpose (controlling SwitchBot devices via the SwitchBot Cloud API); it requires a local credentials file and makes HTTPS calls to api.switch-bot.com and otherwise behaves as expected.

Purpose & Capability

Name/description, SKILL.md, and the included Python script are coherent: they implement SwitchBot Cloud API calls to list devices, read status, and send commands. No unrelated services, binaries, or credentials are requested.

Instruction Scope

Runtime instructions stay within the expected scope: they ask the human to obtain a SwitchBot token/secret, store them in ~/.config/switchbot/credentials.json, run the included script for discovery and control, and optionally record device IDs in TOOLS.md. Note: instructing the user to add device IDs to TOOLS.md may store device identifiers in agent tooling/docs — this is expected for convenience but is a potential privacy consideration.

Install Mechanism

There is no install spec; this is an instruction-only skill with a bundled Python script that uses only standard-library modules. Nothing is downloaded or extracted from untrusted URLs.

Credentials

The skill asks the user to place a token and secret in a local credentials file (reasonable and proportionate). One small inconsistency: the registry metadata shows no primary credential or required env vars even though credentials are required via the config file; this is a metadata omission rather than a security red flag. Protecting the credentials file (chmod 600) as instructed is important.

Persistence & Privilege

always is false and the skill does not request persistent system-wide privileges or modify other skills. The skill can be invoked autonomously by the agent (platform default), which is normal; no elevated persistence is requested.

Assessment

This skill appears to do what it says, but review and follow these precautions before use: - Verify origin/trust: source is 'unknown' — only install/run if you trust the publisher or after you inspect the code (you have the script here). - Protect credentials: follow the SKILL.md advice (store token/secret in ~/.config/switchbot/credentials.json with chmod 600). Do not paste the token/secret into chat or public logs. - Consider secrets management: if you prefer, store credentials in a local secret manager and modify the script to read them securely instead of a file. - Limit exposure: run the script on a machine/network you control; it's benign but it can send commands to your devices. - Device ID privacy: updating TOOLS.md with device IDs is convenient but leaks device identifiers to your agent/tooling — avoid putting secrets or sensitive location info in that file. - Test safely: test with a non-critical device first (e.g., a light) to confirm expected behavior. - Rotate keys if compromised: if you accidentally expose the token/secret, rotate them via the SwitchBot app/dev settings. If you want a higher assurance level, request an auditable provenance (who published the skill) or run the script in an isolated environment before granting the skill regular use.

Control SwitchBot devices through the Cloud API v1.1.

First-Time Setup

Guide your human through these steps:

1. Get API Credentials

Ask your human to:

1. Open SwitchBot App on their phone
2. Go to Profile (bottom right)
3. Tap Preferences (or Settings)
4. Find About → Developer Options
5. Copy Token and Secret Key

2. Store Credentials Securely

mkdir -p ~/.config/switchbot
chmod 700 ~/.config/switchbot

cat > ~/.config/switchbot/credentials.json << 'EOF'
{
  "token": "YOUR_TOKEN_HERE",
  "secret": "YOUR_SECRET_HERE"
}
EOF
chmod 600 ~/.config/switchbot/credentials.json

3. Discover Devices

Run the discovery script to find all devices:

python3 <skill_path>/scripts/switchbot.py list

4. Update Your TOOLS.md

After discovery, note your device IDs in TOOLS.md for quick reference:

## SwitchBot Devices
| Device | ID | Type |
|--------|-----|------|
| Living Room Curtain | ABC123 | Curtain3 |
| Bedroom Light | DEF456 | Plug Mini |

Usage

List All Devices

python3 <skill_path>/scripts/switchbot.py list

Curtain Control

# Open curtain (position 0 = fully open)
python3 <skill_path>/scripts/switchbot.py curtain <device_id> open

# Close curtain (position 100 = fully closed)
python3 <skill_path>/scripts/switchbot.py curtain <device_id> close

# Set specific position (0-100)
python3 <skill_path>/scripts/switchbot.py curtain <device_id> 50

Plug/Light Control

python3 <skill_path>/scripts/switchbot.py plug <device_id> on
python3 <skill_path>/scripts/switchbot.py plug <device_id> off

Check Sensor Status

python3 <skill_path>/scripts/switchbot.py status <device_id>

Generic Command

python3 <skill_path>/scripts/switchbot.py command <device_id> <command> [parameter]

Supported Devices

Device Type	Commands
Curtain / Curtain3	open, close, setPosition
Plug Mini / Plug	turnOn, turnOff, toggle
Bot	press, turnOn, turnOff
Light / Strip Light	turnOn, turnOff, setBrightness, setColor
Lock	lock, unlock
Humidifier	turnOn, turnOff, setMode
Meter / MeterPlus	(read-only: temperature, humidity)
Hub / Hub Mini / Hub 2	(gateway only)

Error Handling

Status Code	Meaning
100	Success
151	Device offline
152	Command not supported
160	Unknown command
161	Invalid parameters
190	Internal error

Tips for Agents

1. First interaction: If no credentials exist, guide the human through setup
2. Device aliases: Create friendly names in TOOLS.md (e.g., "living room" → device ID)
3. Batch operations: Multiple devices can be controlled in sequence
4. Status checks: Use status command before reporting sensor readings
5. Error recovery: If device is offline (151), suggest checking Hub connection

Security Notes

• Credentials file should be chmod 600
• Never log or display the token/secret
• API calls are made over HTTPS to api.switch-bot.com