Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tuya/tuya-openclaw-skills --skill musegit clone --depth 1 https://github.com/tuya/tuya-openclaw-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tuya/tuya-openclaw-skills/muse)<a href="https://agentmods.dev/skills/tuya/tuya-openclaw-skills/muse"><img src="https://agentmods.dev/badge/skills/tuya/tuya-openclaw-skills/muse/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tuya/tuya-openclaw-skills/muse"><img src="https://agentmods.dev/badge/skills/tuya/tuya-openclaw-skills/muse.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.02542 |
| Opus 5.5 | $0.00033 | $0.01017 |
| Sonnet 5.5 | $0.00017 | $0.00508 |
| Haiku 4.5 | $0.00008 | $0.00254 |
Grade A, and why
gadget-tuya-cloud-devices scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tuya Cloud Devices: End-User API Control
Use this skill when the user supplies a Tuya end-user API key (sk-...) and asks to control or
query devices from their Tuya app account. Devices are reached in the cloud, so no local keys or
model-specific datapoint maps are needed. For direct local-TCP control with a confirmed key and
datapoint schema, prefer Tuya Wi-Fi devices.
Prerequisites
Read and follow the Home Link networking and safety rules in ~/docs/devices/home_link.md.
-
A user-supplied end-user API key, applied for at https://tuya.ai/. Treat it as a credential: pass it in a header, never log or echo it.
-
Send
Authorization: Bearer <key>on every call. Pick the base URL from the first two characters aftersk-; it must match the account's region. If the prefix is not listed, ask the user to confirm the key was issued for an international account at https://tuya.ai/. -
Responses share one envelope:
{"success": true, "result": ...}or{"success": false, "code", "msg"}. On1010the key expired — ask for a fresh one. On429back off and honorRetry-After. List endpoints return everything in one response; there is no pagination.
Workflow
- List homes with
GET /v1.0/end-user/homes/all, and rooms withGET /v1.0/end-user/homes/{home_id}/roomswhen the user names one. - Locate the device:
GET /v1.0/end-user/devices/all, or scope to.../homes/{home_id}/devicesor.../homes/room/{room_id}/devices. Each entry inresult.devices[]carriesdevice_id,name,category,category_name,onlineand, under a home scope,room_id. Match the user's words againstcategory_namefirst, then fuzzy-matchname. With multiple matches, list the candidates with their rooms and ask. - Read
GET /v1.0/end-user/devices/{device_id}/detail. Anullresultmeans the device does not exist or the key has no access — stop.online: falsemeans report the device as offline and command nothing.result.propertiesmaps each property code to its current value. - Read the thing model
GET /v1.0/end-user/devices/{device_id}/model. Itsresult.modelfield is a JSON string that needs a second parse.services[].properties[]then defines each property'scode,accessMode(roproperties are read-only — say so) andtypeSpec:value:min,max,stepandscale— the real-world value is the raw number divided by 10^scale.enum: the issued value must be one ofrange.bool/string:true/false, andmaxlenrespectively. Common codes areswitch_led/switch(bool power),bright_value/temp_value(0–1000),temp_set(16–30) andmode(enum) — the model response is always authoritative.
- Issue
POST /v1.0/end-user/devices/{device_id}/shadow/properties/issuewith a body whosepropertiesvalue is a JSON string, not an object — it is double-serialized:{"properties": "{\"switch_led\":true}"}. An emptyresultobject means the command was accepted, not that it took effect. For relative asks ("a bit brighter"), adjust the current value by 10% of the typeSpec range for vague amounts or by the stated amount exactly, clamp to[min, max], honorscaleand round tostep. - Wait 1–2 seconds, re-read the detail and compare the mapped value before reporting success.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed 9224c3ab7762
- 10d ago First seen · 148 lines · 83 tokens per session scan A 56ca20cfb866
gadget-tuya-cloud-devices is a skill published in the GitHub repository tuya/tuya-openclaw-skills (482 stars, last pushed 8d ago), licensed MIT. It adds 83 tokens to every session and 2,542 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-08.
Other skills, from other repositories
gke-compute-classes
Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto…
jetson-diagnostic
Read-only Jetson health snapshot for identity, memory, GPU, thermal, power, storage, services, and top processes.
offensive-z-wave
Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting…
doca-socket-relay
Use this skill when the operator is driving the DOCA Socket Relay to bridge a socket-oriented host application onto a BlueField DPU peer without rewriting it — picking the deployment shape (in-process, sidecar, or BlueField service container), configuring the host-side socket and the DPU-side forwarding endpoint…
hsb-flash
Flash the FPGA on an HSB board connected to an NVIDIA devkit. Supports HSB Lattice boards (FPGA versions 2407, 2412, 2507, 2510) and Leopard Imaging VB1940 "all-in-one" cameras (FPGA versions 2507, 2510). Uses release-specific YAML manifests and board-type-specific program commands. Lattice and VB1940 commands must…
jetson-validate-image
Use after jetson-flash-image to run static BSP checks, on-target smoke/regression tests on a flashed DUT, or both. Not for build or flash steps. Triggers: validate bsp, on-target validation.