技能 home-assistant-manager

📦

home-assistant-manager

Name: home-assistant-manager
Author: komal-SkyNET

內容修訂 r1 中風險 🌐 網路存取📁 檔案系統存取🔑 環境變數⚙️ 外部命令

管理 Home Assistant 部署

當部署、重新載入和儀表板以手動方式處理時，Home Assistant 變更可能具有風險。此技能為 Claude、Codex 和 Claude Code 提供用於驗證、部署、測試和疑難排解的結構化工作流程。

支援: Claude Codex Code(CC)

⚠️ 50 差

Maintain this Skill? Claim it ⚠️ 50 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "home-assistant-manager" from https://skillstore.io/skills/komal-skynet-home-assistant-manager.md and its manifest at https://skillstore.io/api/skills/komal-skynet-home-assistant-manager/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/komal-skynet-home-assistant-manager.md 已簽名 manifest GET /api/skills/komal-skynet-home-assistant-manager/manifest 已簽名 lockfile GET /api/skills/komal-skynet-home-assistant-manager/lockfile

測試它

正在使用「home-assistant-manager」。使用者要求新增前門通知自動化。

預期結果:

助理提出自動化行為、識別必要實體、建議重新載入而非重新啟動，並列出驗證、觸發、日誌和通知檢查。

正在使用「home-assistant-manager」。使用者詢問為什麼儀表板沒有顯示在側邊欄中。

預期結果:

助理檢查儀表板檔案是否存在、是否已註冊、是否需要重新啟動，以及瀏覽器快取是否需要重新整理。

正在使用「home-assistant-manager」。使用者回報範本比較錯誤。

預期結果:

助理說明可能的型別不相符，建議範本型別轉換，然後概述如何測試範本並確認日誌乾淨。

安全審計

中風險

v9 • 2026/7/9 開啟版本化報告

The skill is not malicious, but it intentionally guides privileged Home Assistant operations through SSH, hass-cli, git, and scp. Confirmed risks center on remote command execution, writing Home Assistant .storage files, persistent token setup, and commands that can affect real devices; many scanner hits were Markdown, template, or screenshot false positives. No prompt injection attempt was found in the reviewed files.

已掃描檔案

1,023

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (2)

中

README.md:294-296

Long-Lived Home Assistant Token in Shell Profile

The README tells users to add HASS_SERVER and HASS_TOKEN values to shell startup files. A Home Assistant token stored there can be exposed to shells, subprocesses, backups, or accidental sharing.

The setup instructions explicitly name ~/.bashrc or ~/.zshrc and then export HASS_TOKEN on the following line. This is a real secret persistence risk, although it is normal setup guidance rather than malicious behavior.

中

SKILL.md:164-177 SKILL.md:555-583

Automation Trigger Commands Can Affect Physical Devices

The skill encourages manual Home Assistant automation triggers and service calls during verification. Depending on the target automation, these actions can affect locks, climate, lights, notifications, or other connected devices.

The cited workflow directly invokes automation.trigger and common service-call commands. The impact depends on the user environment, but the physical-device side effect risk is clear.

能力複核項目 (33)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

README.md:294

Hidden file in home directory

# Set environment variables (add to ~/.bashrc or ~/.zshrc)

The README advises adding Home Assistant environment variables to ~/.bashrc or ~/.zshrc, and the nearby setup includes a long-lived access token. Persisting control tokens in shell startup files increases exposure.

中

README.md:294

Hidden file access

# Set environment variables (add to ~/.bashrc or ~/.zshrc)

The README directs users to modify hidden shell startup files for Home Assistant environment variables. This is common setup guidance, but it can persist sensitive access tokens broadly.

中

SKILL.md:25

Ruby/shell backtick execution

1. SSH access to Home Assistant instance (`root@homeassistant.local`)

The skill requires SSH access to root@homeassistant.local, enabling privileged remote management of Home Assistant. This is intended functionality, but it can change or restart the user system.

中

SKILL.md:26

Ruby/shell backtick execution

2. `hass-cli` installed locally

The skill instructs use of hass-cli with Home Assistant credentials to query state or call services. This is intended management behavior, but service calls can alter the running home automation system.

中

SKILL.md:35

Ruby/shell backtick execution

All `hass-cli` commands use environment variables automatically:

中

SKILL.md:37-47

Ruby/shell backtick execution

```bash

中

SKILL.md:51-63

Ruby/shell backtick execution

```bash

The documented workflow runs SSH, git, or Home Assistant CLI operations against the remote /config environment. These commands are legitimate for this skill but carry operational risk if run without confirmation.

中

SKILL.md:71-92

Ruby/shell backtick execution

```bash

中

SKILL.md:96-98

Ruby/shell backtick execution

Use `scp` for quick testing before committing:

The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.

中

SKILL.md:98-112

Ruby/shell backtick execution

```bash

The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.

中

SKILL.md:131-132

Ruby/shell backtick execution

- ✅ Automations: `hass-cli service call automation.reload`

中

SKILL.md:132-133

Ruby/shell backtick execution

- ✅ Scripts: `hass-cli service call script.reload`

中

SKILL.md:133-134

Ruby/shell backtick execution

- ✅ Scenes: `hass-cli service call scene.reload`

中

SKILL.md:134-135

Ruby/shell backtick execution

- ✅ Template entities: `hass-cli service call template.reload`

中

SKILL.md:135-136

Ruby/shell backtick execution

- ✅ Groups: `hass-cli service call group.reload`

中

SKILL.md:136-149

Ruby/shell backtick execution

- ✅ Themes: `hass-cli service call frontend.reload_themes`

中

SKILL.md:149-152

Ruby/shell backtick execution

```bash

中

SKILL.md:155-157

Ruby/shell backtick execution

```bash

中

SKILL.md:160-162

Ruby/shell backtick execution

```bash

中

SKILL.md:165-167

Ruby/shell backtick execution

```bash

The workflow manually triggers an automation through hass-cli. Triggering automations can send notifications or actuate connected devices, so user confirmation is needed.

中

SKILL.md:175-178

Ruby/shell backtick execution

```bash

中

SKILL.md:198-200

Ruby/shell backtick execution

```bash

The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.

中

SKILL.md:203-205

Ruby/shell backtick execution

```bash

The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.

中

SKILL.md:233-250

Ruby/shell backtick execution

```bash

The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.

中

SKILL.md:261-286

Ruby/shell backtick execution

```bash

The workflow instructs copying files to the Home Assistant instance with scp. This can overwrite configuration or dashboard files, so it is a real operational risk even though it is not malicious.

中

SKILL.md:483-485

Ruby/shell backtick execution

```bash

The command reads Home Assistant entity state through authenticated hass-cli access. It is mostly read-only, but it exposes household state data and depends on sensitive credentials.

中

SKILL.md:555-584

Ruby/shell backtick execution

```bash

中

SKILL.md:588-603

Ruby/shell backtick execution

1. **Always check configuration** before restart: `ha core check`

中

SKILL.md:238

Hidden file access

scp .storage/lovelace.control_center root@homeassistant.local:/config/.storage/

This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.

中

SKILL.md:278

Hidden file access

scp .storage/lovelace.new_dashboard root@homeassistant.local:/config/.storage/

This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.

中

SKILL.md:279

Hidden file access

scp .storage/lovelace_dashboards root@homeassistant.local:/config/.storage/

This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.

中

SKILL.md:576

Hidden file access

scp .storage/lovelace.my_dashboard root@homeassistant.local:/config/.storage/

This command copies files into Home Assistant .storage over SSH. That can alter dashboard configuration or registry data, so it is sensitive even when used for legitimate dashboard management.

低

README.md:315

Hardcoded URL

claude mcp add --transport http context7 https://mcp.context7.com/mcp \

The README configures Claude MCP to use the external Context7 endpoint. This is optional documentation access, but it sends requests and a user API key header to a third-party service.

風險因素

🌐 網路存取 (3)

README.md:91 README.md:295 README.md:315

📁 檔案系統存取 (8)

README.md:294 README.md:294 SKILL.md:238 SKILL.md:278 SKILL.md:279 SKILL.md:576 SKILL.md:473 SKILL.md:577

🔑 環境變數 (1)

README.md:316

⚙️ 外部命令 (88)

SKILL.md:25 SKILL.md:26 SKILL.md:28 SKILL.md:35 SKILL.md:37-47 SKILL.md:47-51 SKILL.md:51-63 SKILL.md:63-71 SKILL.md:71-92 SKILL.md:92-96 SKILL.md:96-98 SKILL.md:98-112 SKILL.md:112-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-149 SKILL.md:149-152 SKILL.md:152-155 SKILL.md:155-157 SKILL.md:157-160 SKILL.md:160-162 SKILL.md:162-165 SKILL.md:165-167 SKILL.md:167-175 SKILL.md:175-178 SKILL.md:178-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189 SKILL.md:198-200 SKILL.md:200-203 SKILL.md:203-205 SKILL.md:205-219 SKILL.md:219 SKILL.md:224-233 SKILL.md:233-250 SKILL.md:250-261 SKILL.md:261-286 SKILL.md:286-289 SKILL.md:289-296 SKILL.md:296-312 SKILL.md:312-337 SKILL.md:337-342 SKILL.md:342-351 SKILL.md:351-357 SKILL.md:357-365 SKILL.md:365-368 SKILL.md:368-371 SKILL.md:371-380 SKILL.md:380-387 SKILL.md:387-394 SKILL.md:394-397 SKILL.md:397-404 SKILL.md:404-407 SKILL.md:407-413 SKILL.md:413-415 SKILL.md:415 SKILL.md:426-436 SKILL.md:436-442 SKILL.md:442-452 SKILL.md:452-453 SKILL.md:453-454 SKILL.md:454 SKILL.md:455 SKILL.md:462-463 SKILL.md:463-472 SKILL.md:472-474 SKILL.md:474-477 SKILL.md:477-480 SKILL.md:480-483 SKILL.md:483-485 SKILL.md:485-494 SKILL.md:494-516 SKILL.md:516-519 SKILL.md:519-535 SKILL.md:535-538 SKILL.md:538-551 SKILL.md:551-555 SKILL.md:555-584 SKILL.md:584-588 SKILL.md:588-603 SKILL.md:603-623

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/komal-skynet-home-assistant-manager/security.svg)](https://skillstore.io/skills/komal-skynet-home-assistant-manager?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/komal-skynet-home-assistant-manager?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/komal-skynet-home-assistant-manager/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/komal-skynet-home-assistant-manager.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

komal-SkyNET. (2026). home-assistant-manager security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9

BibTeX 引用

@techreport{komal-skynet-komal-skynet-home-assistant-manager-2026,
  author = {komal-SkyNET},
  title = {home-assistant-manager security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "home-assistant-manager security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "komal-SkyNET"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/komal-skynet-home-assistant-manager/audits/9"
identifiers:
  - type: other
    value: "skillstore:komal-skynet-home-assistant-manager:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

部署 Home Assistant 設定變更

為 YAML、腳本、場景和範本實體規劃驗證、部署、重新載入、重新啟動和驗證步驟。

偵錯自動化失敗

使用日誌、手動觸發、狀態檢查和範本修正來隔離並解決自動化錯誤。

建置適合 tablet 的 Lovelace 儀表板

建立儀表板版面配置、選擇卡片類型、註冊 storage 儀表板，並透過快速預覽工作流程反覆調整。

試試這些提示

檢查我的設定

檢閱我的 Home Assistant 專案設定，並告訴我在部署變更前還缺少哪些 SSH、hass-cli、git 和環境先決條件。

安全地部署自動化

協助我建立並部署 Home Assistant 自動化，然後選擇最安全的重新載入或重新啟動路徑與驗證步驟。

疑難排解儀表板問題

偵錯為什麼我的 Lovelace 儀表板沒有出現或有卡片錯誤，並引導我完成驗證、註冊、部署和瀏覽器檢查。

設計完整工作流程

建立端到端 Home Assistant 變更工作流程，涵蓋本機編輯、驗證、快速測試、git 歷史、部署、rollback、日誌和使用者確認關卡。

最佳實務

在執行 SSH、scp、hass-cli、reload、restart 或 trigger 指令前，確認目標主機、檔案和預期裝置影響。
部署前驗證設定和儀表板語法，部署後檢閱日誌和使用者可見的結果。
使用 scp 進行臨時反覆調整，使用 git 管理穩定變更，並在編輯 Home Assistant storage 檔案前先備份。

避免

不要將長期有效的 Home Assistant token 儲存在共用 shell profiles、repositories、chat logs 或 screenshots 中。
當目標式 reload 可以安全套用變更時，不要 restart Home Assistant。
不要在沒有使用者核准和 rollback 計畫的情況下覆寫 .storage 儀表板檔案或觸發自動化。