SwitchBot Smart Home Control
WarnAudited by ClawScan on May 10, 2026.
Overview
The skill mostly does what it says, but it gives the agent broad smart-home control, including arbitrary SwitchBot commands for sensitive devices like locks and plugs, without clear safety confirmation or scoping.
Install only if you are comfortable letting the agent control your SwitchBot devices through your API token. Before use, protect the credentials file, review any TOOLS.md device aliases, and require manual confirmation for locks, plugs, batch operations, or any generic command.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A mistaken or overbroad agent action could unlock a door, turn off a plug, move curtains, or send an unintended command to a real device.
The skill documents a raw command path to the SwitchBot API. In combination with the supported-device list that includes locks and other physical devices, this grants broad mutation authority without documented approval, allowlisting, or safety checks.
python3 <skill_path>/scripts/switchbot.py command <device_id> <command> [parameter]
Require explicit user confirmation for locks, plugs, and batch operations; prefer device-specific safe commands over the generic command path; and consider removing or restricting raw commands.
Anyone or any agent process that can read this credentials file may be able to control the user's SwitchBot devices.
The skill requires a SwitchBot API token and secret stored locally. This is expected for the integration and the docs advise chmod 600, but the credential grants delegated access to the user's SwitchBot account/devices.
Copy **Token** and **Secret Key** ... cat > ~/.config/switchbot/credentials.json
Store the credentials only on trusted machines, keep file permissions restrictive, rotate the token if exposed, and avoid installing this skill where untrusted agents or users can read the file.
Users have less context for who maintains the skill or where to verify updates.
The skill's provenance is not documented. The provided code is visible and has no install-time dependency execution, so this is a provenance note rather than evidence of malicious behavior.
Source: unknown Homepage: none
Review the included source before use and prefer a version with a documented repository or maintainer provenance.
A bad or outdated device alias could make the agent control the wrong curtain, plug, light, or lock.
The skill suggests persisting device IDs and aliases in a shared agent reference file. This is useful, but stale or incorrect mappings could cause future commands to target the wrong device.
After discovery, note your device IDs in TOOLS.md for quick reference
Keep TOOLS.md device mappings minimal, accurate, and user-reviewed, especially for locks and other safety-sensitive devices.