Habilidades home-assistant-manager
📦
home-assistant-manager
Revisão do conteúdo r1 Risco Médio 🌐 Acesso à rede📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente⚙️ Comandos externos
Gerir Deployments do Home Assistant
As alterações no Home Assistant podem ser arriscadas quando deployments, reloads e dashboards são geridos manualmente. Esta skill fornece ao Claude, Codex e Claude Code fluxos de trabalho estruturados para validação, deployment, testes e resolução de problemas.
Suporta: Claude Codex Code(CC)
Pare e solicite confirmação antes de instalar.
Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.
Instalar com meu Agente
Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.
Solicitação do agente
Review the Skillstore skill "home-assistant-manager" from https://skillstore.io/skills/komal-skynet-home-assistant-manager.md and its manifest at https://skillstore.io/api/skills/komal-skynet-home-assistant-manager/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.
Recursos legíveis por agentes
Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.
Testar
Usando "home-assistant-manager". O utilizador pede para adicionar uma automação de notificação da porta da frente.
Resultado esperado:
O assistente propõe o comportamento da automação, identifica as entidades necessárias, recomenda um reload em vez de um reinício e lista verificações de validação, acionamento, logs e notificações.
Usando "home-assistant-manager". O utilizador pergunta por que motivo um dashboard não aparece na barra lateral.
Resultado esperado:
O assistente verifica se o ficheiro do dashboard existe, se está registado, se é necessário reiniciar e se a cache do navegador precisa de ser atualizada.
Usando "home-assistant-manager". O utilizador relata um erro de comparação de template.
Resultado esperado:
O assistente explica a provável incompatibilidade de tipos, recomenda conversão de tipos no template e depois descreve como testar o template e confirmar que os logs estão limpos.
Auditoria de segurança
Risco Médiov9 • 09/07/2026 Abrir o relatório versionado
The skill is not malicious, but it intentionally guides privileged Home Assistant operations through SSH, hass-cli, git, and scp. Confirmed risks center on remote command execution, writing Home Assistant .storage files, persistent token setup, and commands that can affect real devices; many scanner hits were Markdown, template, or screenshot false positives. No prompt injection attempt was found in the reviewed files.
3
Arquivos analisados
1,023
Linhas analisadas
33
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (2)
Médio
Long-Lived Home Assistant Token in Shell Profile
The README tells users to add HASS_SERVER and HASS_TOKEN values to shell startup files. A Home Assistant token stored there can be exposed to shells, subprocesses, backups, or accidental sharing.
The setup instructions explicitly name ~/.bashrc or ~/.zshrc and then export HASS_TOKEN on the following line. This is a real secret persistence risk, although it is normal setup guidance rather than malicious behavior.
Médio
Automation Trigger Commands Can Affect Physical Devices
The skill encourages manual Home Assistant automation triggers and service calls during verification. Depending on the target automation, these actions can affect locks, climate, lights, notifications, or other connected devices.
The cited workflow directly invokes automation.trigger and common service-call commands. The impact depends on the user environment, but the physical-device side effect risk is clear.
Itens de revisão de capacidade (33)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Alto
Hidden file in home directory
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README advises adding Home Assistant environment variables to ~/.bashrc or ~/.zshrc, and the nearby setup includes a long-lived access token. Persisting control tokens in shell startup files increases exposure.
Médio
Hidden file access
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README directs users to modify hidden shell startup files for Home Assistant environment variables. This is common setup guidance, but it can persist sensitive access tokens broadly.
Médio
Ruby/shell backtick execution
1. SSH access to Home Assistant instance (`root@homeassistant.local`)
The skill requires SSH access to root@homeassistant.local, enabling privileged remote management of Home Assistant. This is intended functionality, but it can change or restart the user system.
Médio
Ruby/shell backtick execution
2. `hass-cli` installed locally
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
All `hass-cli` commands use environment variables automatically:
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
```bash
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Médio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Médio
Ruby/shell backtick execution
Use `scp` for quick testing before committing:
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Médio
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Médio
Ruby/shell backtick execution
- ✅ Automations: `hass-cli service call automation.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
- ✅ Scripts: `hass-cli service call script.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
- ✅ Scenes: `hass-cli service call scene.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
- ✅ Template entities: `hass-cli service call template.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
- ✅ Groups: `hass-cli service call group.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
- ✅ Themes: `hass-cli service call frontend.reload_themes`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Médio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Médio
Ruby/shell backtick execution
```bash
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Médio
Ruby/shell backtick execution
```bash
The workflow manually triggers an automation through hass-cli. Triggering automations can send notifications or actuate connected devices, so user confirmation is needed.
Médio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Médio
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
Médio
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
Médio
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Médio
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Médio
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
Médio
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Médio
Ruby/shell backtick execution
1. **Always check configuration** before restart: `ha core check`
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Médio
Hidden file access
scp .storage/lovelace.control_center root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Médio
Hidden file access
scp .storage/lovelace.new_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Médio
Hidden file access
scp .storage/lovelace_dashboards root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Médio
Hidden file access
scp .storage/lovelace.my_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Baixo
Hardcoded URL
claude mcp add --transport http context7 https://mcp.context7.com/mcp \
The README configures Claude MCP to use the external Context7 endpoint. This is optional documentation access, but it sends requests and a user API key header to a third-party service.
Fatores de risco
🌐 Acesso à rede (3)
📁 Acesso ao sistema de arquivos (8)
🔑 Variáveis de ambiente (1)
⚙️ Comandos externos (88)
SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:35 SKILL.md:37-47 SKILL.md:47-51 SKILL.md:51-63 SKILL.md:63-71 SKILL.md:71-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-112 SKILL.md:112-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-149 SKILL.md:149-152 SKILL.md:152-155 SKILL.md:155-157 SKILL.md:157-160 SKILL.md:160-162 SKILL.md:162-165 SKILL.md:165-167 SKILL.md:167-175 SKILL.md:175-178 SKILL.md:178-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189 SKILL.md:198-200 SKILL.md:200-203 SKILL.md:203-205 SKILL.md:205-219 SKILL.md:219 SKILL.md:224-233 SKILL.md:233-250 SKILL.md:250-261 SKILL.md:261-286 SKILL.md:286-289 SKILL.md:289-296 SKILL.md:296-312 SKILL.md:312-337 SKILL.md:337-342 SKILL.md:342-351 SKILL.md:351-357 SKILL.md:357-365 SKILL.md:365-368 SKILL.md:368-371 SKILL.md:371-380 SKILL.md:380-387 SKILL.md:387-394 SKILL.md:394-397 SKILL.md:397-404 SKILL.md:404-407 SKILL.md:407-413 SKILL.md:413-415 SKILL.md:415 SKILL.md:426-436 SKILL.md:436-442 SKILL.md:442-452 SKILL.md:452-453 SKILL.md:453-454 SKILL.md:454 SKILL.md:455 SKILL.md:462-463 SKILL.md:463-472 SKILL.md:472-474 SKILL.md:474-477 SKILL.md:477-480 SKILL.md:480-483 SKILL.md:483-485 SKILL.md:485-494 SKILL.md:494-516 SKILL.md:516-519 SKILL.md:519-535 SKILL.md:535-538 SKILL.md:538-551 SKILL.md:551-555 SKILL.md:555-584 SKILL.md:584-588 SKILL.md:588-603 SKILL.md:603-623
Auditado por: codex Ver histórico de auditoria →
Compartilhar e citar este relatório
Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.
Copiar link do relatório
https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/komal-skynet-home-assistant-manager?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/komal-skynet-home-assistant-manager?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/komal-skynet-home-assistant-manager/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Cartão incorporável
<iframe src="https://skillstore.io/embed/skills/komal-skynet-home-assistant-manager.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citações acadêmicas (APA · BibTeX · CFF)
Citação APA
komal-SkyNET. (2026). home-assistant-manager security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9Citação BibTeX
@techreport{komal-skynet-komal-skynet-home-assistant-manager-2026,
author = {komal-SkyNET},
title = {home-assistant-manager security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "home-assistant-manager security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "komal-SkyNET"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9"
identifiers:
- type: other
value: "skillstore:komal-skynet-home-assistant-manager:audit:9"
description: "Skillstore immutable audit report identifier"
Pontuação do Skillstore
Por que esta pontuação Confiança das evidências: Médio 55
Arquitetura
85
Manutenibilidade
87
Conteúdo
71
Comunidade
78
Conformidade com a especificação
O que você pode criar
Fazer deployment de alterações de configuração do Home Assistant
Planear etapas de validação, deployment, reload, reinício e verificação para YAML, scripts, cenas e entidades de template.
Depurar falhas de automação
Usar logs, acionamentos manuais, verificações de estado e correções de templates para isolar e resolver erros de automação.
Criar dashboards Lovelace adequados para tablets
Criar layouts de dashboards, escolher tipos de cartões, registar dashboards de armazenamento e iterar com fluxos de pré-visualização rápida.
Teste estes prompts
Verificar a minha configuração
Revê a configuração do meu projeto Home Assistant e diz-me quais os pré-requisitos de SSH, hass-cli, git e ambiente que faltam antes de eu fazer deployment das alterações.
Fazer deployment seguro de uma automação
Ajuda-me a criar e fazer deployment de uma automação do Home Assistant, depois escolhe o caminho mais seguro de reload ou reinício e as etapas de verificação.
Resolver um problema de dashboard
Depura por que motivo o meu dashboard Lovelace não aparece ou tem erros de cartões, e orienta-me pela validação, registo, deployment e verificações no navegador.
Desenhar um fluxo de trabalho completo
Cria um fluxo de trabalho completo de alterações do Home Assistant que cubra edições locais, validação, testes rápidos, histórico git, deployment, rollback, logs e pontos de confirmação do utilizador.
Boas práticas
- Confirmar o host de destino, ficheiros e efeitos esperados nos dispositivos antes de executar comandos SSH, scp, hass-cli, reload, restart ou trigger.
- Validar a configuração e a sintaxe do dashboard antes do deployment, depois rever logs e resultados visíveis ao utilizador após o deployment.
- Usar scp para iteração temporária, git para alterações estáveis e backups antes de editar ficheiros de armazenamento do Home Assistant.
Evitar
- Não armazenar tokens de longa duração do Home Assistant em perfis de shell partilhados, repositórios, logs de chat ou capturas de ecrã.
- Não reiniciar o Home Assistant quando um reload direcionado pode aplicar a alteração com segurança.
- Não sobrescrever ficheiros de dashboard .storage nem acionar automações sem aprovação do utilizador e um plano de rollback.
Perguntas frequentes
Em que é que esta skill ajuda?
Ajuda a planear edições de configuração do Home Assistant, deployments, verificações de automações, revisão de logs e fluxos de trabalho de dashboards Lovelace.
Requer acesso ao meu servidor Home Assistant?
Sim. Os fluxos de trabalho documentados requerem acesso SSH aprovado pelo utilizador, acesso a hass-cli e credenciais do Home Assistant.
Pode criar dashboards?
Fornece padrões para dashboards Lovelace, ficheiros de armazenamento, registo de dashboards, seleção de visualizações e layouts adequados para tablets.
Pode alterar dispositivos na minha casa?
Pode orientar chamadas de serviço e acionamentos de automações que podem afetar dispositivos se o utilizador aprovar esses comandos.
Isto é apenas para Claude Code?
A skill foi escrita para fluxos de trabalho no estilo do Claude Code, e os metadados do marketplace também indicam compatibilidade com Claude e Codex.
O que devo rever antes de a utilizar?
Rever credenciais, host de destino, aprovações de comandos, backups, configuração gerada e qualquer automação que possa afetar dispositivos físicos.
Detalhes do desenvolvedor
Autor
komal-SkyNETLicença
MIT
Revisão da Skillstore
r1
Aviso de versão
O autor não declarou uma versão.
Referência
b959ebfd1043a07c0c4378ab94ca4342cb0259f5
Atualidade da manutenção
18/07/2026
Uso
7 downloads · 236 visualizações
Estrutura de arquivos