📦
homeassistant-config
81更快构建 Home Assistant YAML
由 ESJavadex
当 automations、secrets 和 dashboards 不断增多时，Home Assistant YAML 很容易出错。此技能提供模式、示例和本地验证器，帮助你更安全地处理配置工作。
DevOps 与基础设施 查看
技能 home-assistant-manager
📦
home-assistant-manager
内容修订 r1 中风险 🌐 网络访问📁 文件系统访问🔑 环境变量⚙️ 外部命令
管理 Home Assistant 部署
当部署、重新加载和仪表板都手动处理时，Home Assistant 更改可能存在风险。此技能为 Claude、Codex 和 Claude Code 提供用于验证、部署、测试和故障排查的结构化工作流。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "home-assistant-manager" from https://skillstore.io/skills/komal-skynet-home-assistant-manager.md and its manifest at https://skillstore.io/api/skills/komal-skynet-home-assistant-manager/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“home-assistant-manager”。 用户要求添加一个前门通知自动化。
预期结果:
助手提出自动化行为，识别所需实体，建议重新加载而不是重启，并列出验证、触发、日志和通知检查。
正在使用“home-assistant-manager”。 用户询问为什么仪表板没有显示在侧边栏中。
预期结果:
助手检查仪表板文件是否存在、是否已注册、是否需要重启，以及浏览器缓存是否需要刷新。
正在使用“home-assistant-manager”。 用户报告模板比较错误。
预期结果:
助手解释可能的类型不匹配，建议进行模板类型转换，然后概述如何测试模板并确认日志干净。
安全审计
中风险v9 • 2026/7/9 打开版本化报告
The skill is not malicious, but it intentionally guides privileged Home Assistant operations through SSH, hass-cli, git, and scp. Confirmed risks center on remote command execution, writing Home Assistant .storage files, persistent token setup, and commands that can affect real devices; many scanner hits were Markdown, template, or screenshot false positives. No prompt injection attempt was found in the reviewed files.
3
已扫描文件
1,023
分析行数
33
复核项
0
已忽略误报
已确认安全问题 (2)
中
Long-Lived Home Assistant Token in Shell Profile
The README tells users to add HASS_SERVER and HASS_TOKEN values to shell startup files. A Home Assistant token stored there can be exposed to shells, subprocesses, backups, or accidental sharing.
The setup instructions explicitly name ~/.bashrc or ~/.zshrc and then export HASS_TOKEN on the following line. This is a real secret persistence risk, although it is normal setup guidance rather than malicious behavior.
中
Automation Trigger Commands Can Affect Physical Devices
The skill encourages manual Home Assistant automation triggers and service calls during verification. Depending on the target automation, these actions can affect locks, climate, lights, notifications, or other connected devices.
The cited workflow directly invokes automation.trigger and common service-call commands. The impact depends on the user environment, but the physical-device side effect risk is clear.
能力复核项 (33)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Hidden file in home directory
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README advises adding Home Assistant environment variables to ~/.bashrc or ~/.zshrc, and the nearby setup includes a long-lived access token. Persisting control tokens in shell startup files increases exposure.
中
Hidden file access
# Set environment variables (add to ~/.bashrc or ~/.zshrc)
The README directs users to modify hidden shell startup files for Home Assistant environment variables. This is common setup guidance, but it can persist sensitive access tokens broadly.
中
Ruby/shell backtick execution
1. SSH access to Home Assistant instance (`root@homeassistant.local`)
The skill requires SSH access to root@homeassistant.local, enabling privileged remote management of Home Assistant. This is intended functionality, but it can change or restart the user system.
中
Ruby/shell backtick execution
2. `hass-cli` installed locally
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
All `hass-cli` commands use environment variables automatically:
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
```bash
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
中
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
中
Ruby/shell backtick execution
Use `scp` for quick testing before committing:
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
中
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
中
Ruby/shell backtick execution
- ✅ Automations: `hass-cli service call automation.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
- ✅ Scripts: `hass-cli service call script.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
- ✅ Scenes: `hass-cli service call scene.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
- ✅ Template entities: `hass-cli service call template.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
- ✅ Groups: `hass-cli service call group.reload`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
- ✅ Themes: `hass-cli service call frontend.reload_themes`
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
中
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
中
Ruby/shell backtick execution
```bash
The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.
中
Ruby/shell backtick execution
```bash
The workflow manually triggers an automation through hass-cli. Triggering automations can send notifications or actuate connected devices, so user confirmation is needed.
中
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
中
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
中
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
中
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
中
Ruby/shell backtick execution
```bash
The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.
中
Ruby/shell backtick execution
```bash
The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.
中
Ruby/shell backtick execution
```bash
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
中
Ruby/shell backtick execution
1. **Always check configuration** before restart: `ha core check`
The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.
中
Hidden file access
scp .storage/lovelace.control_center root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
中
Hidden file access
scp .storage/lovelace.new_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
中
Hidden file access
scp .storage/lovelace_dashboards root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
中
Hidden file access
scp .storage/lovelace.my_dashboard root@homeassistant.local:/config/.storage/
This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.
低
Hardcoded URL
claude mcp add --transport http context7 https://mcp.context7.com/mcp \
The README configures Claude MCP to use the external Context7 endpoint. This is optional documentation access, but it sends requests and a user API key header to a third-party service.
风险因素
🌐 网络访问 (3)
📁 文件系统访问 (8)
🔑 环境变量 (1)
⚙️ 外部命令 (88)
SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:35 SKILL.md:37-47 SKILL.md:47-51 SKILL.md:51-63 SKILL.md:63-71 SKILL.md:71-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-112 SKILL.md:112-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-149 SKILL.md:149-152 SKILL.md:152-155 SKILL.md:155-157 SKILL.md:157-160 SKILL.md:160-162 SKILL.md:162-165 SKILL.md:165-167 SKILL.md:167-175 SKILL.md:175-178 SKILL.md:178-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189 SKILL.md:198-200 SKILL.md:200-203 SKILL.md:203-205 SKILL.md:205-219 SKILL.md:219 SKILL.md:224-233 SKILL.md:233-250 SKILL.md:250-261 SKILL.md:261-286 SKILL.md:286-289 SKILL.md:289-296 SKILL.md:296-312 SKILL.md:312-337 SKILL.md:337-342 SKILL.md:342-351 SKILL.md:351-357 SKILL.md:357-365 SKILL.md:365-368 SKILL.md:368-371 SKILL.md:371-380 SKILL.md:380-387 SKILL.md:387-394 SKILL.md:394-397 SKILL.md:397-404 SKILL.md:404-407 SKILL.md:407-413 SKILL.md:413-415 SKILL.md:415 SKILL.md:426-436 SKILL.md:436-442 SKILL.md:442-452 SKILL.md:452-453 SKILL.md:453-454 SKILL.md:454 SKILL.md:455 SKILL.md:462-463 SKILL.md:463-472 SKILL.md:472-474 SKILL.md:474-477 SKILL.md:477-480 SKILL.md:480-483 SKILL.md:483-485 SKILL.md:485-494 SKILL.md:494-516 SKILL.md:516-519 SKILL.md:519-535 SKILL.md:535-538 SKILL.md:538-551 SKILL.md:551-555 SKILL.md:555-584 SKILL.md:584-588 SKILL.md:588-603 SKILL.md:603-623
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/komal-skynet-home-assistant-manager?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/komal-skynet-home-assistant-manager?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/komal-skynet-home-assistant-manager/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/komal-skynet-home-assistant-manager.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
komal-SkyNET. (2026). home-assistant-manager security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9BibTeX 引用
@techreport{komal-skynet-komal-skynet-home-assistant-manager-2026,
author = {komal-SkyNET},
title = {home-assistant-manager security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "home-assistant-manager security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "komal-SkyNET"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9"
identifiers:
- type: other
value: "skillstore:komal-skynet-home-assistant-manager:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
71
社区
78
规范符合性
你能构建什么
部署 Home Assistant 配置更改
为 YAML、脚本、场景和模板实体规划验证、部署、重新加载、重启和验证步骤。
调试自动化失败
使用日志、手动触发、状态检查和模板修复来定位并解决自动化错误。
构建适合平板的 Lovelace 仪表板
创建仪表板布局、选择卡片类型、注册 storage 仪表板，并通过快速预览工作流进行迭代。
试试这些提示
检查我的设置
检查我的 Home Assistant 项目设置，并告诉我在部署更改前还缺少哪些 SSH、hass-cli、git 和环境先决条件。
安全部署一个自动化
帮助我创建并部署一个 Home Assistant 自动化，然后选择最安全的重新加载或重启路径以及验证步骤。
排查仪表板问题
调试我的 Lovelace 仪表板为何没有显示或出现卡片错误，并指导我完成验证、注册、部署和浏览器检查。
设计完整工作流
创建一个端到端的 Home Assistant 更改工作流，涵盖本地编辑、验证、快速测试、git 历史、部署、回滚、日志和用户确认关卡。
最佳实践
- 在运行 SSH、scp、hass-cli、reload、restart 或 trigger 命令之前，确认目标主机、文件和预期的设备影响。
- 部署前验证配置和仪表板语法，然后在部署后审查日志和用户可见的结果。
- 使用 scp 进行临时迭代，使用 git 处理稳定更改，并在编辑 Home Assistant storage 文件前进行备份。
避免
- 不要将长期有效的 Home Assistant token 存储在共享 shell 配置文件、仓库、聊天日志或截图中。
- 当有针对性的 reload 可以安全应用更改时，不要重启 Home Assistant。
- 未经用户批准且没有回滚计划，不要覆盖 .storage 仪表板文件或触发自动化。
常见问题
这个技能可以帮助做什么？
它有助于规划 Home Assistant 配置编辑、部署、自动化检查、日志审查和 Lovelace 仪表板工作流。
它需要访问我的 Home Assistant 服务器吗？
是的。文档中的工作流需要用户批准的 SSH 访问权限、hass-cli 访问权限和 Home Assistant 凭据。
它可以创建仪表板吗？
它提供 Lovelace 仪表板、storage 文件、仪表板注册、视图选择和适合平板的布局模式。
它可以更改我家中的设备吗？
如果用户批准这些命令，它可以指导可能影响设备的服务调用和自动化触发。
这只适用于 Claude Code 吗？
该技能是为 Claude Code 风格的工作流编写的，市场元数据也列出了与 Claude 和 Codex 的兼容性。
使用它之前我应该检查什么？
检查凭据、目标主机、命令批准、备份、生成的配置，以及任何可能影响物理设备的自动化。
开发者详情
作者
komal-SkyNET许可证
MIT
Skillstore 修订
r1
版本提示
作者未声明版本。
引用
b959ebfd1043a07c0c4378ab94ca4342cb0259f5
维护新鲜度
2026/7/23
使用量
8 次下载 · 236 次浏览
文件结构
相关技能
查看全部📦
building-plugins
83构建 Claude Code 插件
由 C0ntr0lledCha0s
创建 Claude Code 插件需要正确的结构、验证、文档和安全打包。此技能将指导用户完成插件架构、模板、验证和发布工作流。
DevOps 与基础设施 查看
📦
building-hooks
83构建 Claude Code 自动化钩子
由 C0ntr0lledCha0s
Claude Code hooks 可以自动执行检查、格式化和策略强制执行，但不安全的 hook 脚本可能会影响本地文件或命令。此技能会引导用户进行结构化的 hook 设计、验证和维护。
DevOps 与基础设施 查看
📦
writing-hookify-rules
82为 Claude Code 编写 Hookify 规则
由 anthropics
在 bash、file、stop 和 prompt 事件中正确编写 hook 规则可能并不容易。此技能为 Claude、Codex 和 Claude Code 提供创建和测试 Hookify 规则的实用指导。
DevOps 与基础设施 查看
📦
wp-wpcli-and-ops
81更安全地运行 WordPress WP-CLI 操作
由 Automattic
当 WP-CLI 指向错误站点时，WordPress 操作可能会损坏数据。此技能会指导备份、dry runs、目标检查以及可重复的命令工作流。
DevOps 与基础设施 查看
📦
automation-integration-preflight-action
80Audit Webpages for Integration Readiness
由 tinyopsstudio
Teams need reliable evidence before investing in web automation or integrations. This skill checks public pages through TinyOps and returns readiness findings, risks, and acceptance guidance.
DevOps 与基础设施 查看