Alexa Cli.Bak

Control Amazon Alexa devices and smart home via the `alexacli` CLI. Use when a user asks to speak/announce on Echo devices, control lights/thermostats/locks,...

Security Scan

This skill is internally consistent: it simply instructs the agent to use the alexacli CLI to control Alexa devices, and its installs/requirements line up with that purpose — but you should verify the upstream project and be cautious with stored tokens and playing remote audio.

Purpose & Capability

Name/description (control Echo devices via alexacli) match the declared requirements and install methods. The brew formula and Go module point to the same upstream repo (buddyh/alexa-cli) referenced in the SKILL.md homepage, so the requested binaries and installs are appropriate for the stated purpose.

Instruction Scope

SKILL.md contains only command examples for alexacli (auth, devices, speak, command, ask, play, etc.). It references the config path (~/.alexa-cli/config.json) and token lifetime but does not instruct reading unrelated system files. However, the provided commands allow powerful actions (announce to all devices, send arbitrary voice commands, play remote audio), which are expected for this use but should be considered high-impact capabilities.

Install Mechanism

Install options are standard: a Homebrew formula (buddyh/tap/alexacli) and a Go module (github.com/buddyh/alexa-cli). Both are expected for this CLI and point to the public GitHub project. These are moderate-risk install sources (they pull code from upstream) but proportionate to the skill's needs; no obscure download URLs or extract-from-untrusted-host steps are present.

Credentials

The skill does not require secrets; SKILL.md lists ALEXA_REFRESH_TOKEN as optional. The CLI stores authentication in ~/.alexa-cli/config.json (refresh tokens valid ~14 days). Requesting an optional refresh token and using a config file is reasonable, but these tokens grant control over your Alexa account and should be treated as sensitive.

Persistence & Privilege

always is false and the skill does not request persistent system-wide privileges. It does not modify other skills' configs. Normal autonomous invocation is allowed (disable-model-invocation is false), which is the platform default.

Assessment

This skill is coherent with its description, but before installing: verify the Homebrew formula and Go module point to the official buddyh/alexa-cli project and review that upstream code; be aware alexacli uses an unofficial Amazon API and stores refresh tokens in ~/.alexa-cli/config.json (treat tokens as sensitive); understand that the skill can announce messages, send arbitrary voice commands, and play remote audio — these are powerful actions that could be misused if you give access to untrusted agents or tokens. If you want to reduce risk, run the CLI manually rather than granting autonomous agent invocation, or create a restricted Alexa account for this purpose.

Alexa CLI

Use alexacli to control Amazon Echo devices and smart home via the unofficial Alexa API.

Authentication

# Browser login (recommended)
alexacli auth

# Non-US accounts
alexacli auth --domain amazon.de
alexacli auth --domain amazon.co.uk

# Check auth status
alexacli auth status
alexacli auth status --verify    # validate token against API

# Remove credentials
alexacli auth logout

Token is valid ~14 days. Configuration stored in ~/.alexa-cli/config.json.

Devices

alexacli devices
alexacli devices --json

Text-to-Speech

# Speak on a specific device
alexacli speak "Hello world" -d "Kitchen Echo"

# Announce to ALL devices
alexacli speak "Dinner is ready!" --announce

# Device name matching is flexible
alexacli speak "Build complete" -d Kitchen

Voice Commands (Smart Home Control)

Send any command as if you spoke it to Alexa:

# Lights, switches, plugs
alexacli command "turn off the living room lights" -d Kitchen
alexacli command "dim the bedroom lights to 50 percent" -d Bedroom

# Thermostats
alexacli command "set thermostat to 72 degrees" -d Bedroom
alexacli command "what's the temperature inside" -d Kitchen

# Locks
alexacli command "lock the front door" -d Kitchen

# Music
alexacli command "play jazz music" -d "Living Room"
alexacli command "stop" -d "Living Room"

# Questions
alexacli command "what's the weather" -d Kitchen

# Timers
alexacli command "set a timer for 10 minutes" -d Kitchen

Ask (Get Response Back)

Send a command and capture Alexa's text response:

alexacli ask "what's the thermostat set to" -d Kitchen
# Output: The thermostat is set to 68 degrees.

alexacli ask "what's on my calendar today" -d Kitchen --json

Alexa+ (LLM Conversations)

Interact with Amazon's LLM-powered assistant:

# Quick start - auto-selects conversation
alexacli askplus -d "Echo Show" "What's the capital of France?"

# Multi-turn retains context
alexacli askplus -d "Echo Show" "What about Germany?"

# List conversations
alexacli conversations

# View conversation history
alexacli fragments "amzn1.conversation.xxx"

Audio Playback

Play MP3 audio through Echo devices:

alexacli play --url "https://example.com/audio.mp3" -d "Echo Show"

Requirements: MP3 at 48kbps, 22050Hz sample rate, HTTPS URL.

History

alexacli history
alexacli history --limit 5
alexacli history --json

Command Reference

Command	Description
alexacli devices	List all Echo devices
alexacli speak <text> -d <device>	Text-to-speech on device
alexacli speak <text> --announce	Announce to all devices
alexacli command <text> -d <device>	Voice command (smart home, music, etc.)
alexacli ask <text> -d <device>	Send command, get response back
alexacli conversations	List Alexa+ conversation IDs
alexacli fragments <id>	View Alexa+ conversation history
alexacli askplus -d <device> <text>	Alexa+ LLM conversation
alexacli play --url <url> -d <device>	Play MP3 via SSML
alexacli auth	Browser login or manual token
alexacli auth status [--verify]	Show auth status
alexacli auth logout	Remove credentials
alexacli history	View recent voice activity

Notes

• Uses Amazon's unofficial API (same as Alexa app)
• Refresh token valid ~14 days, re-run alexacli auth if expired
• Device names support partial, case-insensitive matching
• For AI/agentic use, alexacli command with natural language is preferred
• Add --verbose or -v to any command for debug output