Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

LG ThinQ

v1.0.0

Control LG smart appliances via ThinQ API. Use when user asks about their fridge, washer, dryer, AC, or other LG appliances. Supports checking status, changing temperature, toggling modes (express, eco), and monitoring door status.

0· 1.9k·1 current·1 all-time
byhikaio@kaiofreitas
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match the code and instructions: the CLI uses the ThinQ API (via thinqconnect) to list devices, query status, and send control payloads. Required resources (a ThinQ personal access token and country code file) are directly related to the stated purpose.
Instruction Scope
SKILL.md instructs storing a ThinQ PAT in ~/.config/lg-thinq/token and running the included Python script to interact with devices — this is within scope. Minor issues: the docs reference activating a virtualenv at 'cd ~/clawd && source .venv/bin/activate' (path/name appears inconsistent with the skill slug) and the README doesn't explicitly tell the user to pip-install the thinqconnect/aiohttp dependencies that the script requires. The script reads/writes only under ~/.config/lg-thinq (token, country, devices cache) and sends requests via the ThinQ API; it does not reference unrelated system paths.
Install Mechanism
There is no automated install spec (instruction-only plus an included script). That keeps disk changes minimal, but the provided Python script requires third-party packages (thinqconnect, aiohttp). SKILL.md does not provide explicit pip install steps for these dependencies, which is an operational omission but not a sign of maliciousness.
Credentials
No environment variables or unrelated credentials are requested. The skill asks the user to store a ThinQ Personal Access Token as a plaintext file in ~/.config/lg-thinq/token and to set a country code file; this is proportionate to interacting with the ThinQ API. Storing an access token in plaintext is sensitive — the token grants access to the user's devices and should be protected (file permissions, consider more secure storage).
Persistence & Privilege
The skill is not always-enabled and does not request elevated persistence. It caches device lists under ~/.config/lg-thinq/devices.json (expected) and does not modify other skills or system-wide settings.
Assessment
This skill appears to do what it says: it talks to LG ThinQ via the thinqconnect library and uses a Personal Access Token you supply. Before installing, verify the token source (https://connect-pat.lgthinq.com) and keep the token private. Ensure you install the Python dependencies (pip install thinqconnect aiohttp) in a controlled virtualenv; SKILL.md's virtualenv path looks inconsistent — confirm where you keep your venv. Check and restrict permissions on ~/.config/lg-thinq/token and be aware the skill will cache device metadata at ~/.config/lg-thinq/devices.json. If you want stronger protection, consider using a secrets manager or environment-restricted token rather than storing long-lived PATs in plaintext.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🧊 Clawdis
OSmacOS · Linux
latestvk9777ykpaks4yps5twr664pryn7zwxnq
1.9kdownloads
0stars
1versions
Updated 3h ago
v1.0.0
MIT-0
macOS, Linux

LG ThinQ Skill

Control LG smart home appliances via the ThinQ Connect API.

Setup

  1. Get a Personal Access Token from https://connect-pat.lgthinq.com
  2. Store token: echo "YOUR_TOKEN" > ~/.config/lg-thinq/token
  3. Store country code: echo "MX" > ~/.config/lg-thinq/country

Quick Commands

All scripts are in the skill's scripts/ directory. Activate venv first:

cd ~/clawd && source .venv/bin/activate

List Devices

python3 skills/lg-thinq/scripts/thinq.py devices

Get Device Status

python3 skills/lg-thinq/scripts/thinq.py status <device_id>
python3 skills/lg-thinq/scripts/thinq.py status fridge  # alias

Control Refrigerator

# Set fridge temperature (0-6°C)
python3 skills/lg-thinq/scripts/thinq.py fridge-temp 3

# Set freezer temperature (-24 to -14°C typical)
python3 skills/lg-thinq/scripts/thinq.py freezer-temp -15

# Toggle express fridge
python3 skills/lg-thinq/scripts/thinq.py express-fridge on|off

# Toggle express freeze
python3 skills/lg-thinq/scripts/thinq.py express-freeze on|off

# Toggle eco mode
python3 skills/lg-thinq/scripts/thinq.py eco on|off

Washer/Dryer Status

python3 skills/lg-thinq/scripts/thinq.py status washer
python3 skills/lg-thinq/scripts/thinq.py status dryer

Supported Devices

DeviceStatusControl
Refrigerator✅ temp, door, modes✅ temp, express, eco
WashTower Washer✅ state, time⚠️ limited
WashTower Dryer✅ state, time⚠️ limited
Air Conditioner✅ temp, mode✅ temp, mode, fan

Temperature Ranges

  • Fridge: 0°C to 6°C
  • Freezer: -24°C to -14°C (varies by model)

Error Handling

  • NOT_CONNECTED_DEVICE: Device offline, check WiFi or open ThinQ app
  • INVALID_COMMAND_ERROR: Wrong command format or value out of range
  • NOT_PROVIDED_FEATURE: Feature not supported by this model

Natural Language Examples

User says → Action:

  • "check my fridge" → status fridge
  • "set fridge to 5 degrees" → fridge-temp 5
  • "turn on express freeze" → express-freeze on
  • "is the fridge door open?" → status fridge (check doorStatus)
  • "how's the washer doing?" → status washer

Comments

Loading comments...