Habilidades home-assistant-manager
📦
home-assistant-manager
Revisión del contenido r1 Riesgo medio 🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno⚙️ Comandos externos
Gestionar implementaciones de Home Assistant
Los cambios en Home Assistant pueden ser riesgosos cuando las implementaciones, recargas y paneles se gestionan manualmente. Esta skill proporciona a Claude, Codex y Claude Code flujos de trabajo estructurados para validación, implementación, pruebas y resolución de problemas.
Compatible con: Claude Codex Code(CC)
Detente y solicita confirmación antes de instalar.
Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "home-assistant-manager" from https://skillstore.io/skills/komal-skynet-home-assistant-manager.md and its manifest at https://skillstore.io/api/skills/komal-skynet-home-assistant-manager/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "home-assistant-manager". El usuario pide agregar una automatización de notificación para la puerta principal.
Resultado esperado:
El asistente propone el comportamiento de la automatización, identifica las entidades requeridas, recomienda una recarga en lugar de un reinicio y enumera comprobaciones de validación, activación, registros y notificaciones.
Usando "home-assistant-manager". El usuario pregunta por qué un panel no aparece en la barra lateral.
Resultado esperado:
El asistente comprueba si el archivo del panel existe, si está registrado, si se requiere un reinicio y si la caché del navegador necesita actualizarse.
Usando "home-assistant-manager". El usuario informa de un error de comparación de plantilla.
Resultado esperado:
El asistente explica la probable incompatibilidad de tipos, recomienda conversión de tipos en la plantilla y luego describe cómo probar la plantilla y confirmar que los registros están limpios.
Auditoría de seguridad
Riesgo mediov9 • 9/7/2026 Abrir el informe versionado
The skill is not malicious, but it intentionally guides privileged Home Assistant operations through SSH, hass-cli, git, and scp. Confirmed risks center on remote command execution, writing Home Assistant .storage files, persistent token setup, and commands that can affect real devices; many scanner hits were Markdown, template, or screenshot false positives. No prompt injection attempt was found in the reviewed files.
3
Archivos escaneados
1,023
Líneas analizadas
33
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (2)
Medio
Long-Lived Home Assistant Token in Shell Profile
The README tells users to add HASS_SERVER and HASS_TOKEN values to shell startup files. A Home Assistant token stored there can be exposed to shells, subprocesses, backups, or accidental sharing.
The setup instructions explicitly name ~/.bashrc or ~/.zshrc and then export HASS_TOKEN on the following line. This is a real secret persistence risk, although it is normal setup guidance rather than malicious behavior.
Medio
Automation Trigger Commands Can Affect Physical Devices
The skill encourages manual Home Assistant automation triggers and service calls during verification. Depending on the target automation, these actions can affect locks, climate, lights, notifications, or other connected devices.
The cited workflow directly invokes automation.trigger and common service-call commands. The impact depends on the user environment, but the physical-device side effect risk is clear.
Elementos de revisión de capacidades (33)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Hidden file in home directory
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README advises adding Home Assistant environment variables to ~/.bashrc or ~/.zshrc, and the nearby setup includes a long-lived access token. Persisting control tokens in shell startup files increases exposure.
Medio
Hidden file access
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README directs users to modify hidden shell startup files for Home Assistant environment variables. This is common setup guidance, but it can persist sensitive access tokens broadly.
Medio
Ruby/shell backtick execution
1. SSH access to Home Assistant instance (`root@homeassistant.local`)
The skill requires SSH access to root@homeassistant.local, enabling privileged remote management of Home Assistant. This is intended functionality, but it can change or restart the user system.
Medio
Ruby/shell backtick execution
2. `hass-cli` installed locally
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
All `hass-cli` commands use environment variables automatically:
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
```bash
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medio
Ruby/shell backtick execution
Use `scp` for quick testing before committing:
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Medio
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Medio
Ruby/shell backtick execution
- ✅ Automations: `hass-cli service call automation.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
- ✅ Scripts: `hass-cli service call script.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
- ✅ Scenes: `hass-cli service call scene.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
- ✅ Template entities: `hass-cli service call template.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
- ✅ Groups: `hass-cli service call group.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
- ✅ Themes: `hass-cli service call frontend.reload_themes`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medio
Ruby/shell backtick execution
```bash
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medio
Ruby/shell backtick execution
```bash
The workflow manually triggers an automation through hass-cli. Triggering automations can send notifications or actuate connected devices, so user confirmation is needed.
Medio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medio
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
Medio
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
Medio
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Medio
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Medio
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
Medio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medio
Ruby/shell backtick execution
1. **Always check configuration** before restart: `ha core check`
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medio
Hidden file access
scp .storage/lovelace.control_center root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medio
Hidden file access
scp .storage/lovelace.new_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medio
Hidden file access
scp .storage/lovelace_dashboards root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medio
Hidden file access
scp .storage/lovelace.my_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Bajo
Hardcoded URL
claude mcp add --transport http context7 https://mcp.context7.com/mcp \
The README configures Claude MCP to use the external Context7 endpoint. This is optional documentation access, but it sends requests and a user API key header to a third-party service.
Factores de riesgo
🌐 Acceso a red (3)
📁 Acceso al sistema de archivos (8)
🔑 Variables de entorno (1)
⚙️ Comandos externos (88)
SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:35 SKILL.md:37-47 SKILL.md:47-51 SKILL.md:51-63 SKILL.md:63-71 SKILL.md:71-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-112 SKILL.md:112-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-149 SKILL.md:149-152 SKILL.md:152-155 SKILL.md:155-157 SKILL.md:157-160 SKILL.md:160-162 SKILL.md:162-165 SKILL.md:165-167 SKILL.md:167-175 SKILL.md:175-178 SKILL.md:178-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189 SKILL.md:198-200 SKILL.md:200-203 SKILL.md:203-205 SKILL.md:205-219 SKILL.md:219 SKILL.md:224-233 SKILL.md:233-250 SKILL.md:250-261 SKILL.md:261-286 SKILL.md:286-289 SKILL.md:289-296 SKILL.md:296-312 SKILL.md:312-337 SKILL.md:337-342 SKILL.md:342-351 SKILL.md:351-357 SKILL.md:357-365 SKILL.md:365-368 SKILL.md:368-371 SKILL.md:371-380 SKILL.md:380-387 SKILL.md:387-394 SKILL.md:394-397 SKILL.md:397-404 SKILL.md:404-407 SKILL.md:407-413 SKILL.md:413-415 SKILL.md:415 SKILL.md:426-436 SKILL.md:436-442 SKILL.md:442-452 SKILL.md:452-453 SKILL.md:453-454 SKILL.md:454 SKILL.md:455 SKILL.md:462-463 SKILL.md:463-472 SKILL.md:472-474 SKILL.md:474-477 SKILL.md:477-480 SKILL.md:480-483 SKILL.md:483-485 SKILL.md:485-494 SKILL.md:494-516 SKILL.md:516-519 SKILL.md:519-535 SKILL.md:535-538 SKILL.md:538-551 SKILL.md:551-555 SKILL.md:555-584 SKILL.md:584-588 SKILL.md:588-603 SKILL.md:603-623
Auditado por: codex Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/komal-skynet-home-assistant-manager?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/komal-skynet-home-assistant-manager?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/komal-skynet-home-assistant-manager/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/komal-skynet-home-assistant-manager.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
komal-SkyNET. (2026). home-assistant-manager security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9Cita BibTeX
@techreport{komal-skynet-komal-skynet-home-assistant-manager-2026,
author = {komal-SkyNET},
title = {home-assistant-manager security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "home-assistant-manager security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "komal-SkyNET"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9"
identifiers:
- type: other
value: "skillstore:komal-skynet-home-assistant-manager:audit:9"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 55
Arquitectura
85
Mantenibilidad
87
Contenido
71
Comunidad
78
Cumplimiento de la especificación
Lo que puedes crear
Implementar cambios de configuración de Home Assistant
Planificar pasos de validación, implementación, recarga, reinicio y verificación para YAML, scripts, escenas y entidades de plantilla.
Depurar fallos de automatización
Usar registros, activadores manuales, comprobaciones de estado y correcciones de plantillas para aislar y resolver errores de automatización.
Crear paneles Lovelace aptos para tabletas
Crear diseños de paneles, elegir tipos de tarjetas, registrar paneles de almacenamiento e iterar con flujos de vista previa rápidos.
Prueba estos prompts
Revisar mi configuración
Revisa la configuración de mi proyecto de Home Assistant y dime qué requisitos previos de SSH, hass-cli, git y entorno faltan antes de implementar cambios.
Implementar una automatización de forma segura
Ayúdame a crear e implementar una automatización de Home Assistant, luego elige la ruta más segura de recarga o reinicio y los pasos de verificación.
Solucionar un problema de panel
Depura por qué mi panel Lovelace no aparece o tiene errores de tarjetas, y guíame por la validación, el registro, la implementación y las comprobaciones del navegador.
Diseñar un flujo de trabajo completo
Crea un flujo de trabajo integral de cambios de Home Assistant que cubra ediciones locales, validación, pruebas rápidas, historial de git, implementación, reversión, registros y puntos de confirmación del usuario.
Mejores prácticas
- Confirmar el host de destino, los archivos y los efectos esperados en los dispositivos antes de ejecutar comandos SSH, scp, hass-cli, reload, restart o trigger.
- Validar la configuración y la sintaxis del panel antes de la implementación, luego revisar los registros y los resultados visibles para el usuario después de la implementación.
- Usar scp para iteración temporal, git para cambios estables y copias de seguridad antes de editar archivos de almacenamiento de Home Assistant.
Evitar
- No almacenar tokens de Home Assistant de larga duración en perfiles de shell compartidos, repositorios, registros de chat o capturas de pantalla.
- No reiniciar Home Assistant cuando una recarga específica puede aplicar el cambio de forma segura.
- No sobrescribir archivos de panel .storage ni activar automatizaciones sin aprobación del usuario y un plan de reversión.
Preguntas frecuentes
¿Con qué ayuda esta skill?
Ayuda a planificar ediciones de configuración de Home Assistant, implementaciones, comprobaciones de automatización, revisión de registros y flujos de trabajo de paneles Lovelace.
¿Requiere acceso a mi servidor Home Assistant?
Sí. Los flujos de trabajo documentados requieren acceso SSH aprobado por el usuario, acceso a hass-cli y credenciales de Home Assistant.
¿Puede crear paneles?
Proporciona patrones para paneles Lovelace, archivos de almacenamiento, registro de paneles, selección de vistas y diseños aptos para tabletas.
¿Puede cambiar dispositivos en mi hogar?
Puede guiar llamadas de servicio y activadores de automatización que podrían afectar dispositivos si el usuario aprueba esos comandos.
¿Esto es solo para Claude Code?
La skill está escrita para flujos de trabajo de estilo Claude Code, y los metadatos del marketplace también indican compatibilidad con Claude y Codex.
¿Qué debo revisar antes de usarla?
Revisa credenciales, host de destino, aprobaciones de comandos, copias de seguridad, configuración generada y cualquier automatización que pueda afectar dispositivos físicos.
Detalles del desarrollador
Autor
komal-SkyNETLicencia
MIT
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Ref.
b959ebfd1043a07c0c4378ab94ca4342cb0259f5
Actualidad del mantenimiento
18/7/2026
Uso
8 descargas · 236 vistas
Estructura de archivos