📦
Audit History
home-assistant-manager - 9 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v9 Latest | Jul 9, 2026, 04:31 PM | 2 confirmed | 33 | No capability change |
| v8 | Jul 9, 2026, 04:31 PM | 2 confirmed | 33 | No capability change |
| v7 | Jul 5, 2026, 06:12 PM | 2 confirmed | 33 | No capability change |
| v6 | Jun 30, 2026, 05:50 AM | No confirmed findings | 4 | No capability change |
| v5 | Jan 17, 2026, 08:06 AM | No confirmed findings | 0 | No capability change |
| v4 | Jan 17, 2026, 08:06 AM | No confirmed findings | 0 | Network accessFilesystem accessEnv variablesExternal commands |
| v3 | Jan 8, 2026, 02:47 AM | No confirmed findings | 0 | No capability change |
| v2 | Jan 8, 2026, 02:47 AM | No confirmed findings | 0 | No capability change |
| v1 | Jan 8, 2026, 02:47 AM | No confirmed findings | 0 | Baseline |
Audit version 9 Latest
Jul 9, 2026, 04:31 PM
The skill is not malicious, but it intentionally guides privileged Home Assistant operations through SSH, hass-cli, git, and scp. Confirmed risks center on remote command execution, writing Home Assistant .storage files, persistent token setup, and commands that can affect real devices; many scanner hits were Markdown, template, or screenshot false positives. No prompt injection attempt was found in the reviewed files.
3
Files scanned
1,023
Lines analyzed
39
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Long-Lived Home Assistant Token in Shell Profile
The README tells users to add HASS_SERVER and HASS_TOKEN values to shell startup files. A Home Assistant token stored there can be exposed to shells, subprocesses, backups, or accidental sharing.
The setup instructions explicitly name ~/.bashrc or ~/.zshrc and then export HASS_TOKEN on the following line. This is a real secret persistence risk, although it is normal setup guidance rather than malicious behavior.
Medium
Automation Trigger Commands Can Affect Physical Devices
The skill encourages manual Home Assistant automation triggers and service calls during verification. Depending on the target automation, these actions can affect locks, climate, lights, notifications, or other connected devices.
The cited workflow directly invokes automation.trigger and common service-call commands. The impact depends on the user environment, but the physical-device side effect risk is clear.
Capability review items (33)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README advises adding Home Assistant environment variables to ~/.bashrc or ~/.zshrc, and the nearby setup includes a long-lived access token. Persisting control tokens in shell startup files increases exposure.
Medium
Hidden file access
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README directs users to modify hidden shell startup files for Home Assistant environment variables. This is common setup guidance, but it can persist sensitive access tokens broadly.
Medium
Ruby/shell backtick execution
1. SSH access to Home Assistant instance (`root@homeassistant.local`)
The skill requires SSH access to root@homeassistant.local, enabling privileged remote management of Home Assistant. This is intended functionality, but it can change or restart the user system.
Medium
Ruby/shell backtick execution
2. `hass-cli` installed locally
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
All `hass-cli` commands use environment variables automatically:
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
SKILL.md:37-47SKILL.md:51-63SKILL.md:71-92SKILL.md:98-112SKILL.md:149-152SKILL.md:155-157SKILL.md:160-162SKILL.md:165-167SKILL.md:175-178SKILL.md:198-200SKILL.md:203-205SKILL.md:233-250SKILL.md:261-286SKILL.md:483-485SKILL.md:555-584
Ruby/shell backtick execution · 15 occurrences
```bash
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
Use `scp` for quick testing before committing:
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Medium
Ruby/shell backtick execution
- ✅ Automations: `hass-cli service call automation.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Scripts: `hass-cli service call script.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Scenes: `hass-cli service call scene.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Template entities: `hass-cli service call template.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Groups: `hass-cli service call group.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Themes: `hass-cli service call frontend.reload_themes`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
1. **Always check configuration** before restart: `ha core check`
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medium
Hidden file access
scp .storage/lovelace.control_center root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medium
Hidden file access
scp .storage/lovelace.new_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medium
Hidden file access
scp .storage/lovelace_dashboards root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medium
Hidden file access
scp .storage/lovelace.my_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Low
Hardcoded URL
claude mcp add --transport http context7 https://mcp.context7.com/mcp \
The README configures Claude MCP to use the external Context7 endpoint. This is optional documentation access, but it sends requests and a user API key header to a third-party service.
Risk Factors
🌐 Network access (3)
📁 Filesystem access (8)
🔑 Env variables (1)
⚙️ External commands (88)
SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:35 SKILL.md:37-47 SKILL.md:47-51 SKILL.md:51-63 SKILL.md:63-71 SKILL.md:71-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-112 SKILL.md:112-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-149 SKILL.md:149-152 SKILL.md:152-155 SKILL.md:155-157 SKILL.md:157-160 SKILL.md:160-162 SKILL.md:162-165 SKILL.md:165-167 SKILL.md:167-175 SKILL.md:175-178 SKILL.md:178-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189 SKILL.md:198-200 SKILL.md:200-203 SKILL.md:203-205 SKILL.md:205-219 SKILL.md:219 SKILL.md:224-233 SKILL.md:233-250 SKILL.md:250-261 SKILL.md:261-286 SKILL.md:286-289 SKILL.md:289-296 SKILL.md:296-312 SKILL.md:312-337 SKILL.md:337-342 SKILL.md:342-351 SKILL.md:351-357 SKILL.md:357-365 SKILL.md:365-368 SKILL.md:368-371 SKILL.md:371-380 SKILL.md:380-387 SKILL.md:387-394 SKILL.md:394-397 SKILL.md:397-404 SKILL.md:404-407 SKILL.md:407-413 SKILL.md:413-415 SKILL.md:415 SKILL.md:426-436 SKILL.md:436-442 SKILL.md:442-452 SKILL.md:452-453 SKILL.md:453-454 SKILL.md:454 SKILL.md:455 SKILL.md:462-463 SKILL.md:463-472 SKILL.md:472-474 SKILL.md:474-477 SKILL.md:477-480 SKILL.md:480-483 SKILL.md:483-485 SKILL.md:485-494 SKILL.md:494-516 SKILL.md:516-519 SKILL.md:519-535 SKILL.md:535-538 SKILL.md:538-551 SKILL.md:551-555 SKILL.md:555-584 SKILL.md:584-588 SKILL.md:588-603 SKILL.md:603-623
Audited by: codex
Jul 9, 2026, 04:31 PM
The skill is not malicious, but it intentionally guides privileged Home Assistant operations through SSH, hass-cli, git, and scp. Confirmed risks center on remote command execution, writing Home Assistant .storage files, persistent token setup, and commands that can affect real devices; many scanner hits were Markdown, template, or screenshot false positives. No prompt injection attempt was found in the reviewed files.
3
Files scanned
1,023
Lines analyzed
39
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Long-Lived Home Assistant Token in Shell Profile
The README tells users to add HASS_SERVER and HASS_TOKEN values to shell startup files. A Home Assistant token stored there can be exposed to shells, subprocesses, backups, or accidental sharing.
The setup instructions explicitly name ~/.bashrc or ~/.zshrc and then export HASS_TOKEN on the following line. This is a real secret persistence risk, although it is normal setup guidance rather than malicious behavior.
Medium
Automation Trigger Commands Can Affect Physical Devices
The skill encourages manual Home Assistant automation triggers and service calls during verification. Depending on the target automation, these actions can affect locks, climate, lights, notifications, or other connected devices.
The cited workflow directly invokes automation.trigger and common service-call commands. The impact depends on the user environment, but the physical-device side effect risk is clear.
Capability review items (33)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README advises adding Home Assistant environment variables to ~/.bashrc or ~/.zshrc, and the nearby setup includes a long-lived access token. Persisting control tokens in shell startup files increases exposure.
Medium
Hidden file access
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README directs users to modify hidden shell startup files for Home Assistant environment variables. This is common setup guidance, but it can persist sensitive access tokens broadly.
Medium
Ruby/shell backtick execution
1. SSH access to Home Assistant instance (`root@homeassistant.local`)
The skill requires SSH access to root@homeassistant.local, enabling privileged remote management of Home Assistant. This is intended functionality, but it can change or restart the user system.
Medium
Ruby/shell backtick execution
2. `hass-cli` installed locally
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
All `hass-cli` commands use environment variables automatically:
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
SKILL.md:37-47SKILL.md:51-63SKILL.md:71-92SKILL.md:98-112SKILL.md:149-152SKILL.md:155-157SKILL.md:160-162SKILL.md:165-167SKILL.md:175-178SKILL.md:198-200SKILL.md:203-205SKILL.md:233-250SKILL.md:261-286SKILL.md:483-485SKILL.md:555-584
Ruby/shell backtick execution · 15 occurrences
```bash
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
Use `scp` for quick testing before committing:
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
Medium
Ruby/shell backtick execution
- ✅ Automations: `hass-cli service call automation.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Scripts: `hass-cli service call script.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Scenes: `hass-cli service call scene.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Template entities: `hass-cli service call template.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Groups: `hass-cli service call group.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
- ✅ Themes: `hass-cli service call frontend.reload_themes`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
Medium
Ruby/shell backtick execution
1. **Always check configuration** before restart: `ha core check`
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
Medium
Hidden file access
scp .storage/lovelace.control_center root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medium
Hidden file access
scp .storage/lovelace.new_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medium
Hidden file access
scp .storage/lovelace_dashboards root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Medium
Hidden file access
scp .storage/lovelace.my_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
Low
Hardcoded URL
claude mcp add --transport http context7 https://mcp.context7.com/mcp \
The README configures Claude MCP to use the external Context7 endpoint. This is optional documentation access, but it sends requests and a user API key header to a third-party service.
Risk Factors
🌐 Network access (3)
📁 Filesystem access (8)
🔑 Env variables (1)
⚙️ External commands (88)
SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:35 SKILL.md:37-47 SKILL.md:47-51 SKILL.md:51-63 SKILL.md:63-71 SKILL.md:71-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-112 SKILL.md:112-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-149 SKILL.md:149-152 SKILL.md:152-155 SKILL.md:155-157 SKILL.md:157-160 SKILL.md:160-162 SKILL.md:162-165 SKILL.md:165-167 SKILL.md:167-175 SKILL.md:175-178 SKILL.md:178-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189 SKILL.md:198-200 SKILL.md:200-203 SKILL.md:203-205 SKILL.md:205-219 SKILL.md:219 SKILL.md:224-233 SKILL.md:233-250 SKILL.md:250-261 SKILL.md:261-286 SKILL.md:286-289 SKILL.md:289-296 SKILL.md:296-312 SKILL.md:312-337 SKILL.md:337-342 SKILL.md:342-351 SKILL.md:351-357 SKILL.md:357-365 SKILL.md:365-368 SKILL.md:368-371 SKILL.md:371-380 SKILL.md:380-387 SKILL.md:387-394 SKILL.md:394-397 SKILL.md:397-404 SKILL.md:404-407 SKILL.md:407-413 SKILL.md:413-415 SKILL.md:415 SKILL.md:426-436 SKILL.md:436-442 SKILL.md:442-452 SKILL.md:452-453 SKILL.md:453-454 SKILL.md:454 SKILL.md:455 SKILL.md:462-463 SKILL.md:463-472 SKILL.md:472-474 SKILL.md:474-477 SKILL.md:477-480 SKILL.md:480-483 SKILL.md:483-485 SKILL.md:485-494 SKILL.md:494-516 SKILL.md:516-519 SKILL.md:519-535 SKILL.md:535-538 SKILL.md:538-551 SKILL.md:551-555 SKILL.md:555-584 SKILL.md:584-588 SKILL.md:588-603 SKILL.md:603-623
Audited by: codex
Jul 5, 2026, 06:12 PM
The package is a Markdown skill with a supporting dashboard image and no prompt injection text found in the reviewed files. Many static matches are Markdown formatting or documentation placeholders, but the skill intentionally guides agents through SSH, scp, git, hass-cli, and Home Assistant restart workflows. This should require explicit command review, scoped credentials, and careful handling of Home Assistant storage files.
3
Files scanned
1,023
Lines analyzed
39
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Privileged Home Assistant Control Workflow
The skill directs agents to use root SSH, scp, hass-cli, git pull, and Home Assistant restart or reload operations. These actions can change live smart home configuration, expose logs, or disrupt devices if run without explicit review.
Multiple reviewed workflows explicitly use root SSH, scp, git pull, hass-cli service calls, and restart commands. The purpose is legitimate management, but the granted operational authority is broad.
Medium
Plaintext Token Setup Guidance
The README suggests exporting HASS_TOKEN in shell startup files and passing a Context7 API key in a CLI header. These examples may expose user-provided credentials through readable profiles, terminal history, or process listings.
The examples contain placeholders, not embedded secrets, but they document credential handling patterns that can leak real tokens. The cited lines are setup instructions users are expected to follow.
Capability review items (33)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
SKILL.md:51-63SKILL.md:71-92SKILL.md:98-112SKILL.md:149-152SKILL.md:233-250SKILL.md:261-286SKILL.md:555-584
Ruby/shell backtick execution · 7 occurrences
```bash
The surrounding workflow instructs agents to use SSH, scp, git, hass-cli, or Home Assistant restart operations against a live instance. These commands can modify configuration or disrupt service if run without review.
Medium
SKILL.md:37-47SKILL.md:155-157SKILL.md:160-162SKILL.md:165-167SKILL.md:175-178SKILL.md:198-200SKILL.md:203-205SKILL.md:472-474SKILL.md:483-485
Ruby/shell backtick execution · 9 occurrences
```bash
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution
Use `scp` for quick testing before committing:
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution · 3 occurrences
```
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution
- ✅ Automations: `hass-cli service call automation.reload`
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution
- ✅ Scripts: `hass-cli service call script.reload`
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution
- ✅ Scenes: `hass-cli service call scene.reload`
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution
- ✅ Template entities: `hass-cli service call template.reload`
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution
- ✅ Groups: `hass-cli service call group.reload`
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution
- ✅ Themes: `hass-cli service call frontend.reload_themes`
The surrounding text contains hass-cli or SSH command examples for querying state, reloading services, triggering automations, or reading logs. These are legitimate management actions but carry operational and privacy risk.
Medium
Ruby/shell backtick execution
1. **Always check configuration** before restart: `ha core check`
The flagged range includes local validation or workflow command references. The commands are expected and low-impact, but still require user review before execution.
Medium
Hidden file access
scp .storage/lovelace.control_center root@homeassistant.local:/config/.storage/
The workflow copies dashboard files into Home Assistant internal .storage paths over scp. Editing this hidden storage area can corrupt dashboards or expose configuration if mishandled.
Medium
Hidden file access
scp .storage/lovelace.new_dashboard root@homeassistant.local:/config/.storage/
The workflow copies dashboard files into Home Assistant internal .storage paths over scp. Editing this hidden storage area can corrupt dashboards or expose configuration if mishandled.
Medium
Hidden file access
scp .storage/lovelace_dashboards root@homeassistant.local:/config/.storage/
The workflow copies dashboard files into Home Assistant internal .storage paths over scp. Editing this hidden storage area can corrupt dashboards or expose configuration if mishandled.
Medium
Hidden file access
scp .storage/lovelace.my_dashboard root@homeassistant.local:/config/.storage/
The workflow copies dashboard files into Home Assistant internal .storage paths over scp. Editing this hidden storage area can corrupt dashboards or expose configuration if mishandled.
Low
Hardcoded URL
curl -L https://github.com/komal-SkyNET/claude-skill-homeassistant/archive/main.tar.gz | tar xz --st
The README downloads the skill archive over HTTPS and extracts it without a pinned checksum. This is expected installation guidance, but it is a supply-chain risk if the source changes or is compromised.
Low
Hardcoded URL
claude mcp add --transport http context7 https://mcp.context7.com/mcp \
The README configures an optional external Context7 MCP HTTP endpoint. This is disclosed documentation access, but it still sends requests to a third-party service.
Risk Factors
🌐 Network access (3)
📁 Filesystem access (8)
🔑 Env variables (1)
⚙️ External commands (88)
SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:35 SKILL.md:37-47 SKILL.md:47-51 SKILL.md:51-63 SKILL.md:63-71 SKILL.md:71-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-112 SKILL.md:112-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-149 SKILL.md:149-152 SKILL.md:152-155 SKILL.md:155-157 SKILL.md:157-160 SKILL.md:160-162 SKILL.md:162-165 SKILL.md:165-167 SKILL.md:167-175 SKILL.md:175-178 SKILL.md:178-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189 SKILL.md:198-200 SKILL.md:200-203 SKILL.md:203-205 SKILL.md:205-219 SKILL.md:219 SKILL.md:224-233 SKILL.md:233-250 SKILL.md:250-261 SKILL.md:261-286 SKILL.md:286-289 SKILL.md:289-296 SKILL.md:296-312 SKILL.md:312-337 SKILL.md:337-342 SKILL.md:342-351 SKILL.md:351-357 SKILL.md:357-365 SKILL.md:365-368 SKILL.md:368-371 SKILL.md:371-380 SKILL.md:380-387 SKILL.md:387-394 SKILL.md:394-397 SKILL.md:397-404 SKILL.md:404-407 SKILL.md:407-413 SKILL.md:413-415 SKILL.md:415 SKILL.md:426-436 SKILL.md:436-442 SKILL.md:442-452 SKILL.md:452-453 SKILL.md:453-454 SKILL.md:454 SKILL.md:455 SKILL.md:462-463 SKILL.md:463-472 SKILL.md:472-474 SKILL.md:474-477 SKILL.md:477-480 SKILL.md:480-483 SKILL.md:483-485 SKILL.md:485-494 SKILL.md:494-516 SKILL.md:516-519 SKILL.md:519-535 SKILL.md:535-538 SKILL.md:538-551 SKILL.md:551-555 SKILL.md:555-584 SKILL.md:584-588 SKILL.md:588-603 SKILL.md:603-623
Audited by: codex
Jun 30, 2026, 05:50 AM
Static analysis reported many high-risk patterns, but review found no executable source code or prompt-injection attempt. Most command findings are Markdown examples, while the skill still legitimately directs SSH, scp, hass-cli, token, and Home Assistant storage workflows that can change a live instance.
3
Files scanned
1,023
Lines analyzed
8
Review items
1
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Remote Home Assistant Command Workflows
The static command findings are mostly Markdown backticks, not embedded Ruby execution. However, the skill intentionally instructs use of SSH, hass-cli, git, and scp against a Home Assistant host, which can restart services, alter automations, and change live configuration.
The files clearly document remote operational commands and deployment steps. The intent appears administrative rather than malicious, so the risk is impact from misuse or overbroad permission.
Medium
Home Assistant Token and API Key Handling
The skill expects HASS_SERVER and HASS_TOKEN environment variables and shows an API key header for Context7 setup. These are legitimate prerequisites, but mishandling them can expose Home Assistant or documentation service credentials.
The referenced lines explicitly discuss token-backed environment variables and an API key header. I found no evidence that the skill exfiltrates those secrets.
Medium
Direct Modification of Home Assistant Storage Files
The skill recommends editing and copying files under .storage for Lovelace dashboards. This is a normal Home Assistant workflow in the skill context, but direct writes to hidden storage can corrupt dashboards or bypass safer UI validation if applied incorrectly.
The hidden storage paths and scp deployment steps are explicit. The risk is operational integrity, not confirmed malicious filesystem access.
Low
External Documentation and Download URLs
The hardcoded URLs point to GitHub, Home Assistant documentation, Context7, and support pages. They are expected documentation links, but users should review external downloads before running install commands.
The URLs are visible and tied to installation, documentation, or community resources. I found no evidence of hidden redirects or suspicious endpoints.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static Analyzer False Positives in Markdown
The weak cryptography, Ruby backtick execution, and system reconnaissance alerts are not confirmed as malicious code. They are caused by Markdown examples, common Home Assistant command names, inline code formatting, and documentation text.
Review found documentation content and command snippets rather than executable package code. No prompt-injection text or obfuscated payload was found in README.md or SKILL.md.
Risk Factors
⚙️ External commands (5)
🌐 Network access (4)
📁 Filesystem access (4)
🔑 Env variables (4)
Detected Patterns
Remote Shell and Service Control Examplesscp Deployment to Configuration Directories
Audited by: codex
Jan 17, 2026, 08:06 AM
This is a pure prompt-based skill containing only documentation (SKILL.md, README.md) with example commands and configuration patterns. No executable code, scripts, or direct system access is performed by the skill itself. The static analyzer flagged markdown code fences as 'backtick execution' and documentation links as 'hardcoded URLs' - all false positives from documentation pattern matching. The skill provides Claude with expert knowledge about Home Assistant management workflows.
4
Files scanned
1,219
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
⚙️ External commands (1)
Audited by: claude
Jan 17, 2026, 08:06 AM
This is a pure prompt-based skill containing only documentation (SKILL.md, README.md) with example commands and configuration patterns. No executable code, scripts, or direct system access is performed by the skill itself. The static analyzer flagged markdown code fences as 'backtick execution' and documentation links as 'hardcoded URLs' - all false positives from documentation pattern matching. The skill provides Claude with expert knowledge about Home Assistant management workflows.
4
Files scanned
1,219
Lines analyzed
4
Review items
0
False positives ignored
Risk Factors
🌐 Network access (1)
📁 Filesystem access (1)
🔑 Env variables (1)
⚙️ External commands (1)
Audited by: claude
Jan 8, 2026, 02:47 AM
This is a pure prompt-based skill containing only documentation and guidance. No executable code, scripts, network calls, or file system access is performed by the skill itself. The skill provides Claude with expert knowledge about Home Assistant management workflows.
4
Files scanned
1,038
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 8, 2026, 02:47 AM
This is a pure prompt-based skill containing only documentation and guidance. No executable code, scripts, network calls, or file system access is performed by the skill itself. The skill provides Claude with expert knowledge about Home Assistant management workflows.
4
Files scanned
1,038
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude
Jan 8, 2026, 02:47 AM
This is a pure prompt-based skill containing only documentation and guidance. No executable code, scripts, network calls, or file system access is performed by the skill itself. The skill provides Claude with expert knowledge about Home Assistant management workflows.
4
Files scanned
1,038
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Audited by: claude