Skills ac-nexus
๐ฆ
ac-nexus
v5.3.0 Content revision r1 High Risk โ๏ธ External commands๐ Network access๐ Filesystem access๐ Env variables
Control Air Conditioners with AI Agents
Managing mixed Broadlink and Xiaomi IR air conditioners from an agent can be hard. This skill guides Claude, Codex, and Claude Code through setup, local control, weather checks, schedules, and logs.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "ac-nexus" from https://skillstore.io/skills/oywq00008-cell-ac-nexus.md and its manifest at https://skillstore.io/api/skills/oywq00008-cell-ac-nexus/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "ac-nexus". Check which air conditioner device is active.
Expected outcome:
The active device is the configured living room controller. It is linked to the Broadlink provider and can receive IR commands.
Using "ac-nexus". Add my Xiaomi IR controller.
Expected outcome:
The workflow asks you to scan the Xiaomi login QR code, lists eligible IR controllers, then saves the selected device for local control.
Using "ac-nexus". Use storm information to protect the AC units.
Expected outcome:
The workflow checks active storm distance and wind tier, then asks before pausing schedules or shutting down all configured devices.
Security Audit
High Riskv4 โข 7/5/2026 Open versioned report
Most external-command findings are false positives from Markdown code spans and fenced examples, not executable Ruby backticks. Confirmed risks include hidden durable configuration, API key and device-token handling, persistent physical-device automation, and privacy-sensitive IoT device inventory collection.
1
Files scanned
386
Lines analyzed
11
Review items
0
False positives ignored
Confirmed security concerns (12)
High
Persistent Physical Device Automation
The skill directs agents to create durable schedules and a background scheduler that can keep turning physical air conditioners on or off after the task ends. The file warns about confirmation, but the persistent physical automation remains a safety and consent risk.
The referenced lines explicitly describe durable state, a scheduler daemon, persistent schedule changes, and storm auto-shutdown behavior.
High
Cloud Login Stores Local Device Tokens
The Xiaomi setup flow obtains a QR login session, lists account devices, copies device identifiers and tokens, then saves them to local configuration. This is expected for MIoT control but creates sensitive account and device-token handling risk.
The code sample shows QR login, device enumeration, token extraction, and persistent config saving in one flow.
Medium
Credential-Like Device Token in Example
A MIoT example passes a 32-character token-like value directly to a Device constructor. Even if illustrative, publishing concrete token-shaped values can normalize pasting long-lived device tokens into prompts or logs.
The line contains a private LAN IP and a realistic long hex token in a device-control example, but it may be a placeholder rather than a live secret.
Low
System reconnaissance
Cross-platform AC control library for Broadlink RM series IR blasters and Xiaomi MIoT-compatible IR
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Low
System reconnaissance
| `acnexus_core.xiaomi_local.fetch_miot_spec(model)` | Fetch per-device siid/piid from miot-spec.org
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Low
System reconnaissance
> `send_ac` covers the minimum universal set across all brands. Xiaomi devices use per-model siid/pi
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Low
System reconnaissance
spec = fetch_miot_spec(d["model"]) # Auto-match siid/piid
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Low
System reconnaissance
"miot_spec": spec, # Device-specific siid/piid (optional, safe fallback)
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Show all 12 confirmed findings
Low
System reconnaissance
> โ ๏ธ **Per-device variation:** Not all devices use the same piid values. `fetch_miot_spec(model)` au
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Low
System reconnaissance
**Xiaomi MIoT:** All MIoT-compatible IR remote controllers โ add via QR scan, control via local netw
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Low
System reconnaissance
- Device-specific MIoT siid/piid auto-matched with 7-day local cache
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Low
System reconnaissance
# Use device-specific siid/piid from miot_spec when available
The skill intentionally gathers local IoT device model, provider, and MIoT spec metadata to control air conditioners. This is legitimate for the feature, but it exposes home device inventory and should be disclosed.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
> **This skill writes durable state to the user's machine.** `init()` creates `~/.ac_controller/conf
The documentation explicitly stores durable AC-Nexus state under ~/.ac_controller, including configuration, caches, or custom codes. Hidden home-directory persistence can retain sensitive device data beyond the agent task.
High
Hidden file in home directory
| `init(baidu_key=None, api_key=None, qw_host=None, location=None, brand=None)` | Initialize config
The documentation explicitly stores durable AC-Nexus state under ~/.ac_controller, including configuration, caches, or custom codes. Hidden home-directory persistence can retain sensitive device data beyond the agent task.
High
Hidden file in home directory
| `acnexus_core.xiaomi_local.fetch_miot_spec(model)` | Fetch per-device siid/piid from miot-spec.org
The documentation explicitly stores durable AC-Nexus state under ~/.ac_controller, including configuration, caches, or custom codes. Hidden home-directory persistence can retain sensitive device data beyond the agent task.
High
Hidden file in home directory
| `load_custom_codes()` | Load all custom codes from `~/.ac_controller/custom_codes.json` |
The documentation explicitly stores durable AC-Nexus state under ~/.ac_controller, including configuration, caches, or custom codes. Hidden home-directory persistence can retain sensitive device data beyond the agent task.
High
Hidden file in home directory
- Config auto-persisted to `~/.ac_controller/config.json` (atomic write)
The documentation explicitly stores durable AC-Nexus state under ~/.ac_controller, including configuration, caches, or custom codes. Hidden home-directory persistence can retain sensitive device data beyond the agent task.
High
Generic API/secret keys
| `init(baidu_key=None, api_key=None, qw_host=None, location=None, brand=None)` | Initialize config
The init API accepts weather API keys and the same documentation states configuration is persisted under ~/.ac_controller/config.json. Storing API credentials in durable local config is a real secret-handling risk.
Medium
Hidden file access
> **This skill writes durable state to the user's machine.** `init()` creates `~/.ac_controller/conf
The skill documents reading or writing hidden ~/.ac_controller files for configuration, MIoT cache, or custom IR codes. This is expected behavior but still a real persistence and data exposure risk.
Medium
Hidden file access
| `init(baidu_key=None, api_key=None, qw_host=None, location=None, brand=None)` | Initialize config
The skill documents reading or writing hidden ~/.ac_controller files for configuration, MIoT cache, or custom IR codes. This is expected behavior but still a real persistence and data exposure risk.
Medium
Hidden file access
| `acnexus_core.xiaomi_local.fetch_miot_spec(model)` | Fetch per-device siid/piid from miot-spec.org
The skill documents reading or writing hidden ~/.ac_controller files for configuration, MIoT cache, or custom IR codes. This is expected behavior but still a real persistence and data exposure risk.
Medium
Hidden file access
| `load_custom_codes()` | Load all custom codes from `~/.ac_controller/custom_codes.json` |
The skill documents reading or writing hidden ~/.ac_controller files for configuration, MIoT cache, or custom IR codes. This is expected behavior but still a real persistence and data exposure risk.
Medium
Hidden file access
- Config auto-persisted to `~/.ac_controller/config.json` (atomic write)
The skill documents reading or writing hidden ~/.ac_controller files for configuration, MIoT cache, or custom IR codes. This is expected behavior but still a real persistence and data exposure risk.
Risk Factors
โ๏ธ External commands (69)
SKILL.md:16 SKILL.md:21 SKILL.md:25-29 SKILL.md:29-31 SKILL.md:31-54 SKILL.md:54-60 SKILL.md:60-71 SKILL.md:71-73 SKILL.md:73-76 SKILL.md:76-83 SKILL.md:83-85 SKILL.md:85-89 SKILL.md:89 SKILL.md:90 SKILL.md:91-92 SKILL.md:92 SKILL.md:94-99 SKILL.md:99 SKILL.md:100 SKILL.md:101-102 SKILL.md:102 SKILL.md:104 SKILL.md:109-115 SKILL.md:115-118 SKILL.md:118-143 SKILL.md:143-146 SKILL.md:146-148 SKILL.md:148-153 SKILL.md:153-163 SKILL.md:163-173 SKILL.md:173 SKILL.md:178 SKILL.md:179-180 SKILL.md:180 SKILL.md:181-182 SKILL.md:182-189 SKILL.md:189-190 SKILL.md:190-195 SKILL.md:195-196 SKILL.md:196-197 SKILL.md:197 SKILL.md:198-203 SKILL.md:203-204 SKILL.md:204-205 SKILL.md:205-226 SKILL.md:226-227 SKILL.md:227-228 SKILL.md:228-230 SKILL.md:230 SKILL.md:231-232 SKILL.md:232-233 SKILL.md:233-239 SKILL.md:239-251 SKILL.md:251-254 SKILL.md:254-276 SKILL.md:276-279 SKILL.md:279-298 SKILL.md:298-301 SKILL.md:301-310 SKILL.md:310-313 SKILL.md:313-320 SKILL.md:320-323 SKILL.md:323-328 SKILL.md:328-337 SKILL.md:337-348 SKILL.md:348-351 SKILL.md:351-371 SKILL.md:371-374 SKILL.md:374-377
๐ Network access (7)
๐ Filesystem access (10)
๐ Env variables (3)
Detected Patterns
System reconnaissanceร9
Audited by: codex View Audit History โ
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/oywq00008-cell-ac-nexus/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/oywq00008-cell-ac-nexus?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/oywq00008-cell-ac-nexus?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/oywq00008-cell-ac-nexus/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/oywq00008-cell-ac-nexus.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA ยท BibTeX ยท CFF)
APA citation
oywq00008-cell. (2026). ac-nexus security audit report (audit version 4) [Author version 5.3.0]. Skillstore. https://skillstore.io/skills/oywq00008-cell-ac-nexus/audits/4BibTeX citation
@techreport{oywq00008-cell-oywq00008-cell-ac-nexus-2026,
author = {oywq00008-cell},
title = {ac-nexus security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/oywq00008-cell-ac-nexus/audits/4},
note = {Author version 5.3.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ac-nexus security audit report (audit version 4)"
version: "5.3.0"
type: report
authors:
- name: "oywq00008-cell"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/oywq00008-cell-ac-nexus/audits/4"
identifiers:
- type: other
value: "skillstore:oywq00008-cell-ac-nexus:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
100
Maintainability
87
Content
67
Community
91
Spec Compliance
What You Can Build
Set Up Home AC Control
Configure a Broadlink or Xiaomi IR controller so an agent can turn air conditioners on or off by room.
Build Agent Workflows
Connect Claude, Codex, or Claude Code to AC-Nexus routines for device selection, state checks, and safe command routing.
Automate Weather Responses
Use weather, temperature, and storm signals to adjust cooling or shut down devices with confirmation.
Try These Prompts
Check Current Setup
Use AC-Nexus to review my configured air conditioner devices. Tell me what information you need before sending any control command.
Control One Room
Use AC-Nexus to turn on the air conditioner in the named room at 25 degrees cooling mode. Ask before changing saved schedules.
Add Xiaomi Controller
Guide me through adding a Xiaomi MIoT IR controller with QR login. Explain where tokens and device details will be stored.
Plan Weather Automation
Design a safe AC-Nexus workflow that uses weather and storm data. Include confirmation points before persistent automation is enabled.
Best Practices
- Confirm with the user before changing schedules, auto-adjust rules, device names, or storm shutdown behavior.
- Use meaningful room names so agents can map natural language requests to the correct device.
- Protect the hidden config directory because it may contain API keys, device tokens, and automation rules.
Avoid
- Do not enable persistent schedules or auto-shutdown without explicit user approval.
- Do not paste real device tokens, cloud sessions, or API keys into prompts or logs.
- Do not assume example IP addresses or device models match the user environment.
Frequently Asked Questions
What devices does this skill support?
It targets Broadlink RM IR blasters and Xiaomi MIoT-compatible IR remote controllers used for air conditioner control.
Does it require a desktop GUI?
No. The skill describes Python library workflows that agents can run without a graphical interface.
Where is configuration stored?
The documentation says AC-Nexus stores configuration under a hidden .ac_controller directory in the user home folder.
Can it use weather data?
Yes. It documents Baidu and QWeather weather sources plus storm checks from NMC and NHC data.
Can it control more than one brand?
Yes. The documented provider model separates Broadlink and Xiaomi devices and routes commands by device type.
What needs extra care?
Persistent schedules, API keys, Xiaomi device tokens, and physical device commands require careful confirmation and storage controls.
Developer Details
Author
oywq00008-cellLicense
MIT
Author version
v5.3.0
Skillstore revision
r1
Ref
62e2a730c5cd74eab4c7164309d810de660fcea3
Maintenance freshness
7/18/2026
Usage
2 downloads ยท 0 views
File structure
๐ SKILL.md