Xiaomi

This skill's goal (local miiocli-based control of Xiaomi devices) is reasonable, but take care before installing: - The SKILL.md promises a "scripts/token_extractor.py" and other scripts but the package contains no such files; ask the publisher where the extractor script comes from and inspect it before running. Token extractors require your Xiaomi account credentials and will yield device tokens — treat these as highly sensitive. - The install command embedded in SKILL.md will run pipx and then run pip inside a pipx venv using a hardcoded user-path (/Users/$(whoami)/.local/pipx/...). That may fail or act on unexpected paths; understand and approve any install commands before execution. - If you obtain or run any token-extraction script, review its source to ensure it does not exfiltrate credentials to external servers. Prefer using official, audited tools and only store tokens in a secure location (not plain text references/*.md files). - If you want to proceed, request the missing script(s) and documentation from the skill author or only run the steps in a controlled environment (e.g., an isolated VM) after code review. Given the missing files and the brittle install instructions, I recommend treating this skill as untrusted until the author provides the extractor script and a clearer, platform-neutral install procedure.