skills/hqman/my-skills/mijia/Gen Agent Trust Hub

mijia

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill configuration in pyproject.toml specifies the mijiaapi package as a dependency, which is installed from the standard Python Package Index (PyPI) during the setup process.
  • [COMMAND_EXECUTION]: The skill provides a Python CLI tool (scripts/lamp_cli.py) for device control. The script includes robust input validation, using argparse choices to restrict brightness values to a 1-100 range and mapping mode requests to a hardcoded dictionary of valid integers, preventing arbitrary command injection.
  • [SAFE]: No security concerns were identified. The skill manages device identification via environment variables, avoiding hardcoded secrets. The communication with Xiaomi services is handled through a standard authentication flow (QR code login) described in the setup instructions, and device status data is strictly formatted before being presented to the agent, minimizing indirect injection risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 03:22 PM