mijia
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configuration in
pyproject.tomlspecifies themijiaapipackage as a dependency, which is installed from the standard Python Package Index (PyPI) during the setup process. - [COMMAND_EXECUTION]: The skill provides a Python CLI tool (
scripts/lamp_cli.py) for device control. The script includes robust input validation, usingargparsechoices to restrict brightness values to a 1-100 range and mapping mode requests to a hardcoded dictionary of valid integers, preventing arbitrary command injection. - [SAFE]: No security concerns were identified. The skill manages device identification via environment variables, avoiding hardcoded secrets. The communication with Xiaomi services is handled through a standard authentication flow (QR code login) described in the setup instructions, and device status data is strictly formatted before being presented to the agent, minimizing indirect injection risks.
Audit Metadata