Security checks across malware telemetry and agentic risk
The skill is purpose-aligned for Nest control, but its optional alerting setup can run persistently, expose a local webhook publicly, and automatically send private camera images or home-event data to Telegram and Clawdbot.
Install only if you intentionally want a persistent Nest monitoring service. Use a dedicated least-privilege Google/Nest setup, protect and rotate all tokens, verify cloudflared provenance, restrict or authenticate the webhook, and enable Telegram photo alerts only for chats where sharing home camera images is acceptable.
'Content-Type': 'application/json',
},
)
urllib.request.urlopen(req, timeout=5)
except Exception as e:
print(f"[HOOK] Error: {e}")'Content-Type': f'multipart/form-data; boundary={boundary}',
})
with urllib.request.urlopen(req, timeout=15) as resp:
result = json.loads(resp.read())
if result.get('ok'):
print(f"[TELEGRAM] Photo sent successfully")'Content-Type': 'application/json',
})
with urllib.request.urlopen(req, timeout=10) as resp:
return json.loads(resp.read()).get('ok', False)
except Exception as e:
print(f"[TELEGRAM] Error: {e}")```bash sudo systemctl daemon-reload sudo systemctl enable --now nest-webhook cloudflared-nest ``` ### 6. Create Pub/Sub Push Subscription
63/63 vendors flagged this skill as clean.