Sensibo
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: sensibo Version: 1.0.0 The skill is designed to control Sensibo smart AC devices via their official REST API. All `curl` commands in `SKILL.md` target legitimate Sensibo API endpoints (home.sensibo.com) for AC control, sensor data retrieval, and schedule management. The skill instructs the agent to obtain an API key and device IDs and store them in `TOOLS.md`, which is a standard method for OpenClaw skills to manage necessary credentials for their stated purpose. There is no evidence of data exfiltration to unauthorized destinations, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's intended behavior beyond its stated function.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A wrong device ID, schedule ID, or bulk request could change or remove climate settings for one or more AC units.
The skill documents commands that can delete schedules and apply changes across multiple AC devices. This is aligned with the AC-control purpose, but it is state-changing authority that users should invoke carefully.
Delete Schedule
```bash
curl --compressed -X DELETE "https://home.sensibo.com/api/v1/pods/{device_id}/schedules/{schedule_id}/?apiKey={key}"
```
...
5. **Bulk operations:** Loop through device IDs for "turn off all ACs"Before using write, delete, or bulk operations, confirm the intended room/device and schedule, especially for recurring schedules or all-device requests.
Anyone with the API key may be able to view or control the associated Sensibo devices, depending on Sensibo's API permissions.
The skill requires a Sensibo account API key to access and control devices. This is expected for the integration, but the key likely grants meaningful account/device authority.
1. Get API key from https://home.sensibo.com/me/api
...
**Auth:** `?apiKey={key}` query parameterUse a Sensibo API key only if you trust the environment where the skill runs, avoid sharing it, and rotate the key if it may have been exposed.
If TOOLS.md is shared, synced, exposed in prompts, or readable by other tools, the Sensibo API key could be disclosed.
The setup recommends saving the API key in a persistent markdown file that the agent can later read for device lookup. This is useful for operation, but it stores sensitive credential material in plaintext context.
Store in TOOLS.md:
```markdown
## Sensibo
API Key: `{your_key}`
| Room | Device ID |Keep TOOLS.md private, do not commit or share it, and prefer a secret manager or environment variable if your agent environment supports one.