Philips Hue Thinking Indicator
v1.0.0Visual AI activity indicator using Philips Hue lights. Pulse red when thinking, green when done.
⭐ 1· 1.7k·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's stated purpose requires a 'hue' command-line tool; the SKILL.md, README, and package.json all reference a 'hue' binary, but the provided file list and code attachments do not include the 'hue' executable. Declaring 'hue' as a required binary while not providing it (or an install mechanism) is an incoherence that prevents verification of what will run.
Instruction Scope
Runtime instructions are narrowly scoped to local Hue bridge interaction and shell integration (setup, lights, thinking/done commands). However, hue-hooks.sh exports a hardcoded path (/Users/jesse/...) into PATH and suggests adding it to a user's shell profile — this would inject an external path (creator's local path) into a different system's environment if copied verbatim. quick-setup.sh posts to a hardcoded local IP (192.168.1.151) which is reasonable for Hue registration in principle but should be parameterized for the user's bridge IP.
Install Mechanism
There is no install spec; README and SKILL.md instruct copying a 'hue' file into PATH or using a (non-provided) Homebrew tap. package.json lists './hue' as the binary and as a packaged file, but that binary is absent from the provided manifest. Because the main executable is missing, we cannot inspect what network calls or other behaviors it implements — this is the primary risk/incoherence.
Credentials
The skill requests no environment variables or unrelated credentials. Config is stored under ~/.config/philips-hue/config.json (bridge_ip, username) which aligns with Hue local API usage. No cloud secrets or unrelated service tokens are requested.
Persistence & Privilege
The skill does not request always:true and has normal user-invocable behavior. It suggests adding hooks/aliases to shell startup which is typical for CLI utilities. The hooks file, however, contains a hardcoded export PATH line pointing to the author's local development path — if blindly copied into a user's shell profile it could unintentionally alter PATH and allow unexpected binaries to be picked up. This should be corrected before use.
What to consider before installing
What to consider before installing:
- The package is missing the main 'hue' executable that the skill and README repeatedly reference. Do not install or run any 'hue' command until you obtain and inspect that executable. Ask the author to include the 'hue' script/source or provide a trustworthy install method (e.g., official Homebrew tap or GitHub release) so you can review it.
- Do not run quick-setup.sh blindly: it POSTs to a hardcoded local IP (192.168.1.151). Use your bridge's actual IP and run a manually crafted curl command after verifying it is correct. Prefer manual registration steps documented by Philips Hue if unsure.
- Do not copy hue-hooks.sh verbatim into your shell startup. Remove or edit the export PATH line that references /Users/jesse/... — that path is specific to the author and could cause unintended PATH changes on your machine. Instead create hooks/aliases that call the verified 'hue' binary location you control.
- Before adding any scripts to PATH or running with elevated privileges, inspect the 'hue' binary (or its source) for network endpoints, unexpected remote URLs, or data-exfiltration patterns. If the 'hue' binary is a shell script, review it line-by-line; if it is a compiled binary, request source or a reproducible build.
- If you cannot obtain the 'hue' executable for inspection, treat this package as incomplete and avoid installation. The inconsistencies suggest sloppy packaging at best and make security assessment impossible at worst.
If the missing executable is provided and its code is limited to local Hue Bridge API calls (and hooks are sanitized), the skill appears coherent and low-risk. Without that file, however, the package is suspicious and should not be trusted until fixed and reviewed.Like a lobster shell, security has layers — review code before you run it.
Productivityvk97c8wc2t6m9b6qzf0dsqqqgp580aj69latestvk97c8wc2t6m9b6qzf0dsqqqgp580aj69
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🚦 Clawdis
Binshue