xiaoai-bridge

This skill does roughly what it claims (connect to Xiaomi, poll voice messages, output JSON, and play TTS), but there are important red flags you should address before installing: - Do NOT use credentials included in the bundle (scripts/.mi.json). That file contains a passToken/serviceToken and device identifiers; treat it as compromised and remove it. Always use your own MI_PASS_TOKEN or a dedicated account. - The package metadata omitted required env vars — expect to provide MI_USER_ID, MI_PASS_TOKEN (recommended) or MI_PASSWORD, and MI_DEVICE_ID. Confirm these requirements with the code before running. - Inspect the @mi-gpt/miot dependency yourself (package-lock points to a Tencent mirror). If you cannot verify the registry/mirror, consider installing dependencies from the official npm registry or review the package source. - Because the listener continuously polls and prints conversation text, run the skill in an isolated environment (container or VM) to avoid accidental data leakage. Review logs carefully — the script will output user voice text and device info. - Replace any use of a real personal Xiaomi account with a dedicated/test account if possible. If you ever used the included tokens, rotate credentials immediately. - Investigate the prompt-injection warning in SKILL.md (base64 or other embedded payloads) and remove any unexpected or encoded content. If you are not comfortable auditing the dependency (@mi-gpt/miot) and removing the embedded .mi.json first, treat this skill as unsafe to install in a production environment.