home-assistant

ISSUES FOUND max severity HIGHSkillSpector Caution 50 registry clawhub.ai last scanned 1 scan

3 findings (1 high, 2 medium), mainly data exfiltration, command injection. Most recent scan 2026-02-06.

The home-assistant skill provides legitimate smart home control functionality but has MODERATE security concerns primarily around credential management. The skill requires users to store sensitive long-lived access tokens in plaintext files or environment variables, creating credential exposure risks. The bash script implementation lacks robust input validation and could be vulnerable to injection attacks if malicious entity IDs are provided. The skill does not implement secure credential storage mechanisms. However, the skill's core functionality is legitimate and does not contain malicious code, data exfiltration attempts, or prompt injection. The primary risks are architectural (credential storage) and implementation quality (input validation) rather than intentional threats. With improved credential management and input validation, this skill would be suitable for use.

Scanner's overall assessment (LLM analyzer)
Findings3
Critical0
High1
Medium2
Low0
Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 50
Score50 / 100
Issues6
CategoriesPrivilege Escalation MCP Least Privilege Rogue Agent
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Control Home Assistant smart home devices, run automations, and receive webhook events. Use when controlling lights, switches, climate, scenes, scripts, or any HA entity. Supports bidirectional communication via REST API (outbound) and webhooks (inbound triggers from HA automations).

Package
3 files, 14 KB
SKILL.md
555 words, 12+ sections
Code
Shell (1)
Requires
bins: jq curl

SKILL.md covers: Home Assistant · Setup · Option 1: Config File (Recommended) · Option 2: Environment Variables · Getting a Long-Lived Access Token · Quick Reference · List Entities · Get Entity State · Control Devices · Turn on · Turn off · Set brightness (0-255)

Findings

HIGH Hardcoded Credential Storage in Plaintext Configuration File Data Exfiltrationllm

The skill instructs users to store Home Assistant credentials (URL and long-lived access token) in plaintext configuration files at ~/.config/home-assistant/config.json or as environment variables. Long-lived access tokens provide full API access to Home Assistant, which controls physical smart home devices. Storing these credentials in plaintext creates significant risk of credential theft if the user's system is compromised. The token provides complete control over the smart home including locks, cameras, and other security devices.

SKILL.md

Create `~/.config/home-assistant/config.json`:
```json
{
  "url": "https://your-ha-instance.duckdns.org",
  "token": "your-long-lived-access-token"
}
```
Remediation: Implement secure credential storage using system keychains (macOS Keychain, Windows Credential Manager, Linux Secret Service). Use encrypted storage with appropriate file permissions (0600). Consider implementing token rotation and using short-lived tokens where possible. Add warnings about credential security in documentation.
MEDIUM Credential Exposure via Environment Variables Data Exfiltrationllm

The skill recommends storing Home Assistant credentials in environment variables (HA_URL and HA_TOKEN). Environment variables can be exposed through process listings, shell history, log files, and child processes. This creates multiple vectors for credential leakage, especially in shared or multi-user environments.

SKILL.md

### Option 2: Environment Variables

```bash
export HA_URL="http://homeassistant.local:8123"
export HA_TOKEN="your-long-lived-access-token"
```
Remediation: Prioritize file-based configuration with proper permissions over environment variables. If environment variables must be used, document the security implications and recommend using them only in isolated, single-user environments. Implement credential masking in any logging or error output.
MEDIUM Insufficient Input Validation in Shell Script Command Injectionllm

The bash script (ha.sh) accepts entity IDs and other parameters from command-line arguments without proper validation or sanitization before passing them to curl commands and JSON payloads. While the script uses proper quoting, malicious entity IDs or parameters could potentially be crafted to exploit JSON injection or cause unexpected behavior. The script constructs JSON payloads using string interpolation which could be vulnerable to injection if entity IDs contain special characters.

scripts/ha.sh

api -X POST "$HA_URL/api/services/$domain/turn_on" \
  -d "{\"entity_id\": \"$entity\", \"brightness\": $brightness}"
Remediation: Implement strict input validation for entity IDs (validate format: domain.entity_name with alphanumeric and underscore only). Use jq to construct JSON payloads instead of string interpolation to prevent injection. Add parameter validation for numeric values like brightness. Implement allowlisting for valid domains and service names.

What is in the package

FileKindSize
SKILL.mddoc4.9 KB
references/api.mddoc3.8 KB
scripts/ha.shscript5.4 KB

External hosts referenced

your-ha-instance.duckdns.org

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

HA_URL HA_TOKEN CONFIG_FILE HA_CONFIG

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills