🎁 Get the FREE AI Skills Starter Guide β€” Subscribe β†’
BytesAgainBytesAgain
BytesAgain β€Ί Skills β€Ί Tuya Smart
πŸ¦€ ClawHub

Tuya Smart

by @ivangdavila

Control and automate Tuya Smart devices with official cloud APIs, secure request signing, region-aware routing, and safe command execution.

Versionv1.0.0
Downloads558
Installs1
#devops#legal#automation
TERMINAL
clawhub install tuya

πŸ“– About This Skill

name: Tuya Smart slug: tuya version: 1.0.0 homepage: https://clawic.com/skills/tuya description: Control and automate Tuya Smart devices with official cloud APIs, secure request signing, region-aware routing, and safe command execution. changelog: Initial release with end-to-end Tuya Smart workflows for authentication, account linking, device control, diagnostics, and safe rollout playbooks. metadata: {"clawdbot":{"emoji":"T","requires":{"bins":["curl","jq","openssl"],"env":["TUYA_ACCESS_ID","TUYA_ACCESS_SECRET"]},"primaryEnv":"TUYA_ACCESS_SECRET","os":["linux","darwin","win32"]}}

Setup

On first use, read setup.md and align activation boundaries, cloud region context, and write-safety defaults before sending Tuya commands.

When to Use

Use this skill when the user needs practical execution across the Tuya ecosystem: cloud API authentication, device discovery, DPS-based command control, account linking, or automation orchestration. Use this instead of generic IoT advice when outcomes depend on Tuya Smart API behavior, regional endpoints, request signing, and command validation.

Architecture

Memory lives in ~/tuya/. See memory-template.md for structure and status values.

~/tuya/
|-- memory.md                 # Core context and activation boundaries
|-- environments.md           # Region, project, app-account, and endpoint mapping
|-- devices.md                # Device inventory, capabilities, and command mappings
|-- automations.md            # Cross-device orchestration plans and safeguards
-- incidents.md              # Error signatures, fixes, and verification evidence

Quick Reference

Use the smallest file needed for the current task.

| Topic | File | |-------|------| | Setup and activation behavior | setup.md | | Memory and workspace templates | memory-template.md | | Cloud auth and signing reference | auth-signing.md | | User account and home/device linking | account-linking.md | | Device commands and state workflows | device-operations.md | | Multi-device rollout patterns | orchestration-playbooks.md | | Diagnostics and recovery | troubleshooting.md |

Requirements

  • Tuya IoT Platform project credentials: Access ID and Access Secret
  • Environment variables: TUYA_ACCESS_ID and TUYA_ACCESS_SECRET
  • Correct regional OpenAPI endpoint for the project data center
  • Device permissions enabled in the project (Cloud Authorization and required API groups)
  • For account-based device binding: configured user permission package and app account flow

    • Never ask users to paste production secrets into chat logs. Prefer local environment variables and redacted examples.

    Data Storage

    Keep local operational notes in ~/tuya/:

  • environment and endpoint mappings
  • device command dictionaries by product/device id
  • approved automation policies and rollback plans
  • incident signatures and validated remediations

    • Core Rules

    1. Resolve Region and Project Scope Before Any API Call

  • Confirm project environment, app type, and region endpoint first.
  • Block execution if region and project are ambiguous because token and device calls will fail or target the wrong tenant.

    • 2. Build and Verify Tuya Signature Inputs Exactly

  • Sign every request with Tuya's documented HMAC-SHA256 process.
  • If sign, t, nonce, body hash, or signed headers are inconsistent, treat the request as invalid and rebuild before retrying.

    • 3. Discover Device Capabilities Before Sending Commands

  • Read device details and function schema before writes.
  • Generate commands only from supported code values and valid data types/ranges.

    • 4. Use Read-Before-Write and Read-After-Write Control Loops

  • Capture baseline status before command execution.
  • After each write, verify resulting state and stop rollout on mismatch.

    • 5. Apply Explicit Safety Gates for Real Device Writes

  • Start with read-only inspection and dry-run command plans.
  • Require explicit confirmation before high-impact actions (power, heating, locks, alarms, or bulk updates).

    • 6. Keep Account Linking and Device Ownership Consistent

  • Match app account model, cloud project permissions, and user-device binding flow.
  • If device list and control APIs disagree, reconcile account linkage before troubleshooting commands.

    • 7. Design Automations as Idempotent, Observable Sequences

  • Use deterministic run ids, bounded retries, and clear stop conditions.
  • Track each step with expected state checks to avoid duplicate or partial actions across device fleets.

    • 8. Preserve Security and Privacy Boundaries

  • Use least-privilege credentials and only declared endpoints.
  • Read credentials from environment variables and never write raw secrets to local notes.
  • Treat project tokens as short-lived runtime data and avoid persisting them unless the user explicitly requests it.

    • Common Traps

  • Choosing the wrong regional endpoint -> valid credentials fail and device lookup appears empty.
  • Sending commands without checking function schema -> invalid code/value pairs and rejected writes.
  • Mixing app-account and cloud-account assumptions -> users appear linked but device control fails.
  • Retrying signed requests with stale timestamps/nonces -> repeated signature errors.
  • Running bulk commands without staged verification -> large-scale bad state transitions.
  • Treating online status as control success -> command accepted but target state not achieved.

    • External Endpoints

    | Endpoint | Data Sent | Purpose | |----------|-----------|---------| | https://openapi.tuyaus.com | Signed API headers, device ids, command payloads, and project-scoped metadata | Tuya OpenAPI access for US region projects | | https://openapi-ueaz.tuyaus.com | Signed API headers, device ids, command payloads, and project-scoped metadata | Tuya OpenAPI access for US West region projects | | https://openapi.tuyaeu.com | Signed API headers, device ids, command payloads, and project-scoped metadata | Tuya OpenAPI access for Europe region projects | | https://openapi-weaz.tuyaeu.com | Signed API headers, device ids, command payloads, and project-scoped metadata | Tuya OpenAPI access for Europe West region projects | | https://openapi.tuyacn.com | Signed API headers, device ids, command payloads, and project-scoped metadata | Tuya OpenAPI access for China region projects | | https://openapi.tuyain.com | Signed API headers, device ids, command payloads, and project-scoped metadata | Tuya OpenAPI access for India region projects | | https://developer.tuya.com | Documentation query terms | Validate API behavior, limits, and integration requirements |

    No other data is sent externally.

    Security & Privacy

    Data that leaves your machine:

  • signed Tuya API requests that contain selected device identifiers and command payloads
  • optional account-linking payloads required by Tuya user/device binding APIs

    • Data that stays local:

  • environment mapping, command dictionaries, and automation runbooks under ~/tuya/
  • incident notes and risk decisions

    • This skill does NOT:

  • use undeclared third-party endpoints
  • request bypass or evasion techniques
  • store TUYA_ACCESS_ID or TUYA_ACCESS_SECRET in local skill files
  • execute bulk writes without user confirmation and verification strategy

    • Trust

    This skill sends operational data to Tuya cloud services when execution is approved. Only install if you trust Tuya and your credential handling model with your IoT control data.

    Related Skills

    Install with     clawhub install if user confirms:
  • iot - Device connectivity and system-level IoT integration guidance
  • smart-home - Home automation architecture and reliability practices
  • api - API contract design, auth workflows, and error handling discipline
  • mqtt - Messaging patterns for device telemetry and event-driven orchestration
  • zigbee - Local network device planning and Zigbee ecosystem troubleshooting

    • Feedback

  • If useful: clawhub star tuya
  • Stay updated: clawhub sync`

    • ⚑ When to Use

    TriggerAction
    Use this instead of generic IoT advice when outcomes depend on Tuya Smart API behavior, regional endpoints, request signing, and command validation.

    βš™οΈ Configuration

    On first use, read setup.md and align activation boundaries, cloud region context, and write-safety defaults before sending Tuya commands.