mijia

SUSPICIOUS. The skill’s purpose and commands are coherent for Mijia device control, and there is no direct evidence of hidden execution or credential exfiltration. However, the core control path depends on an unofficial third-party mijiaAPI library that handles Xiaomi authentication and stores tokens locally, creating moderate supply-chain and trust risk.