Xiaomi Miot

This skill appears to implement the described Xiaomi login and device-control flow and uses Feishu to present login cards — that part is coherent. However, the code contains a hard-coded Xiaomi client_secret in login_card.py that contradicts the SKILL.md guidance to pass secrets via environment variables. Before installing or using this skill: - Do not reuse production secrets. Create and use dedicated test FEISHU and Xiaomi OAuth credentials so you can revoke them if needed. - Ask the author to remove the hard-coded client_secret and rely solely on the XIAOMI_CLIENT_SECRET env var (or confirm why the hard-coded value is present). Hard-coded secrets may indicate sloppy engineering or a leaked/stale credential. - Inspect (or request) the full code beyond the truncated portion to confirm there are no additional unexpected network endpoints or data exfiltration. - Verify the token cache path (~/.openclaw/skills/xiaomi-miot/data/token_cache.json) is acceptable for your threat model and ensure filesystem permissions are strict (owner-only). If the author cannot justify or remove the embedded client_secret, treat this as a significant red flag and avoid installing it in production environments.