基于已安装的 xiaodu-control-official 编排儿童睡前场景。当用户说“带孩子睡觉”“开始睡前模式”“帮我哄孩子睡觉”，或要求把房间调整到适合睡觉的状态时使用。这个 skill 会复用 xiaodu-control-official 的现有脚本，对小度智能屏和小度 IoT 设备执行 scene-...
Security Analysis
high confidenceThis skill is an orchestrator that reuses an existing xiaodu-control-official dependency to implement sleep-time routines; its files, instructions, and required footprint are coherent with that stated purpose.
The skill's name and description say it's a scene-orchestrator that reuses xiaodu-control-official scripts; the SKILL.md and included bedtime_story_tail.sh call only those dependency scripts (list/trigger scenes, list/control devices, speak, control_xiaodu). It requests no unrelated credentials or binaries and does not claim capabilities that would require extra system access.
The SKILL.md gives explicit, narrow runtime instructions: check that xiaodu-control-official exists, call its list/trigger/control scripts in a strictly serial order, and optionally write short-term and long-term preference files (XIAODU_CONTEXT.md, MEMORY.md). This stays within the orchestrator purpose. Note: the skill expects to write preference files to the workspace but does not declare config paths; users should be aware these files will be created/updated in the skill workspace.
Instruction-only skill with a small helper script; there is no install spec and no remote downloads. The included bedtime_story_tail.sh is local, simple, and calls dependency scripts rather than fetching code from external URLs.
No environment variables, credentials, or config paths are requested. The helper script uses only passed CLI args and a dependency script path; it does not attempt to read secret env vars or unrelated system files.
always is false and model invocation is allowed (normal). The skill will create/update local preference files (XIAODU_CONTEXT.md, MEMORY.md) in its workspace per its design, which is expected behavior for a preference-orchestrator. It does not request permanent elevated privileges or alter other skills' configs.
Guidance
This skill appears internally consistent: it is an orchestrator that intentionally delegates actual device control to xiaodu-control-official scripts and provides a small local helper to schedule a delayed stop/screen-off. Before installing, verify the following: (1) xiaodu-control-official and its scripts (control_xiaodu.sh, control_iot.sh, etc.) are present and trustworthy, since this skill will invoke them and they perform real device actions; (2) review those dependency scripts for any network endpoints or credential use you don't expect (the orchestrator itself doesn't request secrets but the dependency scripts might); (3) be aware the skill may create or update XIAODU_CONTEXT.md and MEMORY.md in the workspace to store preferences; if you prefer not to persist preferences, confirm or disable that behavior; (4) the bedtime tail script uses sleep for delayed actions — test in a safe environment to confirm timed-stop behavior works as you expect. If you have concerns about autonomous invocation, limit or review when the agent is allowed to call this skill, since it can send commands to real devices via the dependency scripts.
Latest Release
v1.0.0
Initial release
Popular Skills
Published by @dueros-mcp on ClawHub
