华米(Zepp/原小米)运动刷步数

华米运动(Zepp/小米运动)自动刷步数技能，支持多账号管理。当用户提到刷步数、修改运动步数、华米运动、小米运动、手环步数时触发。

Security Scan

The skill's files, dependencies, and runtime instructions are consistent with its stated purpose (automatically submitting step counts to Huami/Zepp accounts), but it requires users to provide plaintext credentials and contains some obfuscated/encoded payloads that should be audited before use.

Purpose & Capability

Name/description match what the code does: Python scripts that log in to Zepp/Huami APIs and submit step data. Declared binaries and Python packages (requests, pycryptodome) are appropriate for network calls and AES usage in the code. No unrelated cloud credentials or services are requested.

Instruction Scope

SKILL.md explicitly instructs the agent to collect account usernames and passwords and store them in config.json, then run the bundled scripts and optionally create cron jobs. That is within the functional scope but is sensitive: it instructs collection and local storage of plaintext credentials and points users to third-party testing sites. The instructions do not ask the agent to exfiltrate data to unexpected endpoints, but they do grant broad discretion to prompt the user for credentials and schedule automated runs.

Install Mechanism

No install spec or external download; the skill ships code files and is executed with python3. No remote installers or archive extracts are used, which reduces supply-chain risk.

Credentials

The skill requests no platform env vars or injected credentials. It does rely on user-supplied account credentials (username/password) which are necessary for its purpose but are stored in plaintext in config.json (SKILL.md also warns about this). The code optionally reads USE_FAKE_IP from the environment although that env var is not declared in metadata — minor mismatch. Hardcoded AES key/IV are present in code (used to format the login payload).

Persistence & Privilege

Skill is not always-enabled, does not request elevated or persistent platform privileges, and does not modify other skills or system-wide agent settings. It does instruct creating cron jobs only if the user asks, which is a normal user-controlled action.

Scan Findings in Context

[base64-block] unexpected: A large encoded/obfuscated blob appears in scripts/huami.py (the long URL-encoded/encoded string used as part of the step submission payload). While embedding encoded payloads may be part of how the submission is formed, opaque long blobs deserve manual review to ensure they do not contain hidden exfiltration or malicious callbacks. The pre-scan flagged a base64-like block in SKILL.md metadata, but the large encoded data is actually in huami.py.

Assessment

This skill implements exactly what it claims (automatically submitting steps), but it requires you to provide real account usernames and passwords and stores them in config.json in plaintext. Before installing or running it: (1) review the scripts yourself — especially the large encoded payload in huami.py — to ensure there is no unexpected network/callback behavior; (2) avoid using your primary accounts (use a throwaway/test account); (3) set strict file permissions (chmod 600 config.json) and run on an isolated/local machine if possible; (4) be aware that automating step submissions may violate Huami/Zepp terms of service and could lead to account action; (5) if you plan to use cron, understand that it will run autonomously with stored credentials; and (6) if you are uncomfortable auditing the code, do not provide real credentials.

AI 执行指南

当用户请求"刷步数"、"修改手环步数"、"帮我刷步"时，按以下流程执行：

1. 账号使用说明

在使用本技能前，需要准备华米运动账号：

小米运动自动刷步数（支持邮箱登录）

小米运动自动刷步数，小米运动APP现已改名 Zepp Life，为方便说明，后面还是称其为小米运动。但下载注册时请搜索 Zepp Life。

账号测试建议

注册账号后建议先去以下网站测试自己的账号刷步数是否正常（注意这些网站只是网络上收集的，不保证安全和有效性）：

• https://steps.hubp.de/ - 提示密码错误时可以多试几次或者切换网络
• https://bs.yanwan.store/run4/ - 验证码001或998

⚠️ 重要提示：如无法刷步数同步到支付宝等，建议重新注册一个新的。

2. 首次使用检查

首次执行前，检查 config.json 是否已配置账号：

cat "${SKILL_DIR}/config.json"

若 accounts 数组为空，按以下步骤引导用户：

1. 询问华米运动账号（手机号或邮箱）
2. 询问密码
3. 询问账号昵称（可选，用于显示）
4. 确认步数范围（默认15000-16000）

然后将账号信息添加到 config.json：

# 编辑 config.json，按以下格式添加账号
# {"name": "昵称", "username": "账号", "password": "密码"}

示例：

{
  "accounts": [
    {
      "name": "我的账号",
      "username": "13800138000",
      "password": "your_password"
    }
  ]
}

3. 执行命令

python3 "${SKILL_DIR}/scripts/brush_step_skill.py" --min-steps {min} --max-steps {max}

参数说明：

• --min-steps: 最小步数（可选，默认15000）
• --max-steps: 最大步数（可选，默认16000）
• --check: 仅检查环境和配置
• --account "名称": 指定刷特定账号（多账号时）

4. 输出解析

成功时输出 "Brush Step Report"，格式：

=== Brush Step Report ===
Range: 15000 - 16000
Status: [OK]
Success: 2/2

1. 账号1: 15678 steps [OK]
2. 账号2: 15234 steps [OK]
========================

失败时输出包含 [FAIL]，需提取失败账号及原因。

4. 结果告知

向用户清晰报告：

• ✅ 成功刷步的账号和步数
• ❌ 失败的账号及错误信息
• 📊 统计（成功数/总数）

5. 定时任务

若用户要求"每天自动刷步"：

1. 使用 cron 工具创建定时任务
2. 推荐时段：每天晚上20:00（0 20 * * *）
3. 可设置不同时间点不同步数实现渐进效果：
   • 9:00 → 10000-12000步
   • 12:00 → 14000-16000步
   • 20:00 → 18000-20000步

6. 错误处理

常见错误及应对：

错误信息	原因	建议
Login failed	账号密码错误	重新询问账号信息
Token failed	网络问题/API限流	等待后重试
Network error	网络不稳定	检查网络后重试
No valid accounts	未配置账号	引导用户填写config.json

8. 安全提醒

⚠️ 密码明文存储在 config.json 中：

• 仅在本地环境使用
• 不要将 config.json 提交到公开仓库
• 定期检查文件权限（chmod 600 config.json）

---

技术实现

配置文件格式

config.json 结构：

{
  "accounts": [
    {"name": "账号1", "username": "13800138000", "password": "xxx"}
  ],
  "step": {"min": 15000, "max": 16000},
  "network": {"use_fake_ip": true}
}

依赖

• requests: HTTP请求
• pycryptodome: AES加密（用于登录）

API端点

• 登录: https://api-user.zepp.com/v2/registrations/tokens
• Token: https://account.huami.com/v2/client/login
• 刷步: https://api-mifit-cn.huami.com/v1/data/band_data.json

---

OpenClaw Skill Compatible