skill-create-pip

Control Ecovacs/DEEBOT robot vacuums via the Ecovacs IoT API. Use when the user wants to control a robot vacuum, check battery, start/stop/pause cleaning, re...

Security Scan

The skill's code and instructions are coherent with its stated purpose (controlling Ecovacs/DEEBOT devices via the Ecovacs IoT API); it talks to Ecovacs hosts and stores a local session file, which is expected for this functionality.

Purpose & Capability

Name/description match the included code and docs. The script implements login, device discovery, and command sending to Ecovacs endpoints (api-app.dc-cn.cn.ecouser.net and device mqs hosts), which is exactly what a robot-control skill should do.

Instruction Scope

SKILL.md instructions align with the python script: login → get devices → send commands. The guidance references only the Ecovacs API, the included files, and a session file (~/.ecovacs_session.json). There are no instructions to read unrelated system files or transmit data to third-party endpoints.

Install Mechanism

No install spec — instruction-only with an included Python script. No downloads from arbitrary URLs or package installs. This is the lowest-risk install model for this functionality.

Credentials

The skill requests no environment variables or external credentials, which is appropriate. It does persistently store phone and password (MD5 or MD5-of-plaintext) and token in ~/.ecovacs_session.json; persisting credentials to a local file is functional but a security/privacy consideration (see user guidance).

Persistence & Privilege

always is false and the skill does not request system-wide changes or modify other skills. Writing a session file under the user's home directory is expected for a client; it does not alter other agent configurations.

Assessment

This skill appears to do what it claims (control Ecovacs vacuums). Before installing: (1) be aware the script stores your phone and password (MD5 or MD5-of-plaintext) plus token in ~/.ecovacs_session.json — protect that file (restrict file permissions) or remove the stored password after login if you prefer. (2) Traffic is sent to Ecovacs endpoints defined in the code; if you require higher assurance, verify those hostnames against official Ecovacs documentation or an official SDK/repo. (3) Because the session file contains credentials, delete or rotate them if you stop using the skill. (4) If you need stricter security, consider running the script in an isolated environment or inspect/modify the code to use a more secure secret store instead of a plaintext session file.

Ecovacs Robot Control

Auth Flow

Three-step flow: Login → Device List → Send Command

Full API details in references/api.md. Core script in scripts/ecovacs.py.

Session Management

Session (token + userid + resource) is stored in ~/.ecovacs_session.json after login. Always load_session() before calling device APIs. Re-login if token expired (errno 3000).

Critical Rule

toType = device's class field from device list (e.g. o0lqjm).
NOT "device" or "USER" — this is the #1 cause of errno:3003 permission denied.

---

Using the Script

# First time login
python3 scripts/ecovacs.py login <phone> <md5_or_plain_password>

# List all devices (shows did, status, name)
python3 scripts/ecovacs.py devices

# Check battery (use did or nick)
python3 scripts/ecovacs.py battery <did>

# Check clean status
python3 scripts/ecovacs.py status <did>

# Start full-house auto clean
python3 scripts/ecovacs.py clean <did> start

# Pause / resume / stop
python3 scripts/ecovacs.py clean <did> pause
python3 scripts/ecovacs.py clean <did> resume
python3 scripts/ecovacs.py clean <did> stop

# Return to dock
python3 scripts/ecovacs.py charge <did>

# Send any arbitrary command
python3 scripts/ecovacs.py cmd <did> getLifeSpan '{"type":"brush,sideBrush,heap"}'
python3 scripts/ecovacs.py cmd <did> setSpeed '{"speed":1}'
python3 scripts/ecovacs.py cmd <did> getWorkMode '{}'

---

Direct API Calls

When using tools directly (not script), follow this pattern:

# 1. Login
session = login(phone, md5(password))

# 2. Get devices
devices = get_devices(session)
device = next(d for d in devices if "T50" in d["deviceName"])

# 3. Send command
result = send_cmd(session, device, "clean_V2", {
    "act": "start",
    "content": {"type": "auto", "count": 1}
})

See references/api.md for full protocol reference:

• Auth & device discovery — login, resource generation, device list fields
• All command payloads — clean_V2, charge, battery, stats, speed, water, workmode, lifespan, autoEmpty, maps, schedules
• State/event codes — error codes, evt codes, clean states

---

Common Protocols Quick Reference

Goal	cmdName	key body.data fields
开始全屋清扫	clean_V2	{act:"start", content:{type:"auto",count:1}}
区域清扫	clean_V2	{act:"start", content:{type:"spotArea",value:"mssid1,mssid2"}}
暂停/继续/停止	clean_V2	{act:"pause/resume/stop"}
回充	charge	{act:"go"}
查电量	getBattery	{}
查清扫状态	getCleanInfo_V2	{}
查本次面积时长	getStats	{}
查/设吸力	getSpeed/setSpeed	{speed:0} (1000静音/0标准/1强劲/2超强)
查/设水量	getWaterInfo/setWaterInfo	{amount:2} (1低/2中/3高/4超高)
查/设扫拖模式	getWorkMode/setWorkMode	{mode:0} (0边扫边拖/1仅扫/2仅拖/3先扫后拖)
查耗材	getLifeSpan	{type:"brush,sideBrush,heap,filter"}
手动集尘	setAutoEmpty	{act:"start"}
查地图列表	getCachedMapInfo	{}
查房间区域	getMapSet	{mid:"<map_id>",type:"ar"}
查预约	getSched_V2	{type:1}

---

Error Handling

errno	meaning
3000	Token expired → re-login
3003	Permission denied → check toType = device class
30000	Device response timeout → device offline
0 (body.code)	Success

---

Accounts (China domestic)

• Login URL: https://api-app.dc-cn.cn.ecouser.net/api/users/user.do
• org: ECOCN, country: CN
• Password: MD5 hex of plaintext