Roborock Vacuum Control via Telegram
v1.0.0Turn a Roborock into a conversational OpenClaw companion. Use when the user wants natural-language vacuum control like clean the kitchen, go home, pause, sta...
⭐ 1· 25·0 current·0 all-time
bySerdar Salim@serdarsalim
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description align with what the code does: the scripts call the local 'roborock' CLI to report status and issue app_* commands and support room aliases. Required binaries (bash, python3, roborock) are appropriate. Minor note: SKILL.md and scripts expect local jojo.env configuration even though the registry lists no required env vars.
Instruction Scope
SKILL.md explicitly instructs running the included wrapper (scripts/jojo.sh) via exec and to create a local jojo.env containing JOJO_DEVICE_ID and optional ROOM_* aliases. The scripts only read local config, environment variables, and call the roborock CLI + python3; they do not contact unexpected external endpoints or read unrelated system data.
Install Mechanism
This is instruction-only (no remote download/install spec). The SETUP.md suggests installing python-roborock via pipx — that's a standard public package. No archive downloads or obscure URLs are used.
Credentials
The skill relies on a local JOJO_DEVICE_ID (jojo.env) and optional ROOM_* environment variables, plus optional overrides like ROBOROCK_BIN and JOJO_CONFIG_FILE; however, the registry metadata does not declare any required env vars or a primary credential. That metadata omission is inconsistent and could mislead users about what secrets/config are needed. The requested config (device id) is proportional to the functionality, but it should be declared in the skill metadata so users know what will be required.
Persistence & Privilege
always:false and no install-time daemonizing code. The scripts run on demand and do not modify other skills or system-wide configurations. They source a local jojo.env only, which is normal for a device-scoped wrapper.
Assessment
This skill appears to do what it says: run the included wrapper which calls your locally installed roborock CLI. Before installing: (1) Inspect and create jojo.env yourself (do not paste tokens into public places); JOJO_DEVICE_ID is required but not declared in the registry — ensure you understand where that file lives. (2) Confirm you are comfortable granting the agent permission to exec the script (OpenClaw exec approvals may be needed). (3) Do not store Telegram bot tokens or other unrelated secrets in jojo.env; bind any Telegram bot to a separate dedicated agent as suggested. (4) If you plan to publish or share the skill, ask the maintainer to add JOJO_DEVICE_ID to the registry metadata so required credentials are explicit.Like a lobster shell, security has layers — review code before you run it.
latestvk979rxh5a8rbns2mzrat074t3h845ak3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🤖 Clawdis
Binsbash, roborock, python3