Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Home Assistant integration that needs a sensitive token and can affect smart-home devices, but its behavior is coherent with its stated purpose and includes meaningful safety guidance.
Install only if you intend to let an agent inspect and, when you authorize it, operate your Home Assistant devices. Use a dedicated least-privilege Home Assistant account where possible, keep HA_TOKEN in a private environment or secret store, prefer verified HTTPS, and require explicit confirmation before any lock, alarm, garage door, security automation, notification, TTS, script, scene, or broad batch action.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The description presents a broad Home Assistant inspection-and-control skill covering both REST and WebSocket workflows plus several specific capability areas. The supplied code is much narrower: it is explicitly read-only except for a weather service call used only to fetch data, and it only exposes a small set of REST endpoints and summaries. There is no code for WebSocket connections, no entity/device registry handling, no Assist, no automations, no energy statistics, and no meaningful control actions. While some declared areas are partially represented (capability discovery, action schema lookup, calendars, basic troubleshooting/health), the overall declared description materially overstates what this code chunk can do.
The skill requires access to a long-lived Home Assistant bearer token, and that token inherits the full authority of its associated HA user. Even though the documentation warns not to print or share it, any skill that depends on reading such credentials materially increases the blast radius of compromise because theft enables surveillance and device control.
Set environment variables:
- `HA_URL` — Your Home Assistant URL (e.g., `http://10.0.0.10:8123`)
- `HA_TOKEN` — An existing access token supplied through the local environment or secret store.
Use HTTPS with verified certificates for remote connections; local HTTP exposes the
token to the network. Use the exact trusted origin, without a trailing `/api`, query
The skill encourages use of the generic /api/template endpoint, which can evaluate templated expressions on the Home Assistant side. Even though the shown example is static, promoting general template execution as a discovery mechanism creates a parameter-abuse surface where later user-controlled entity names or template fragments could be inserted, potentially broadening data access or triggering unintended server-side processing.
-d '{"template": "{{ area_name(\"light.kitchen\") }}"}'
# List all floors and their areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{% for floor in floors() %}{{ floor }}: {{ floor_areas(floor) }}\n{% endfor %}"}'
The note confirms reliance on long-lived access tokens, which are particularly sensitive because they may remain valid for years and can authorize household data access and device operations. In this skill context, token compromise is especially dangerous because the integration spans presence, calendars, locks, alarms, and other real-world systems.
## Notes
- Most endpoints return JSON; templates return text
- Long-lived access tokens have a documented 10-year lifetime and can be revoked; store securely
- Test entity IDs with the list command first
- For locks, alarms, and garage doors — always confirm actions with the user
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
## Credentials and transport
Use existing credentials supplied privately through the environment or a secret
store. The Python readers do not search credential files, browser storage, SSH
keys or cloud configuration. A local JSON file is opened only for an explicitly
requested `validate-config` operation. Reader output redacts the configured token;
it does not automatically remove other private household data.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
store. The Python readers do not search credential files, browser storage, SSH
keys or cloud configuration. A local JSON file is opened only for an explicitly
requested `validate-config` operation. Reader output redacts the configured token;
it does not automatically remove other private household data.
The readers connect only to the validated origin, ignore environment proxies,
verify HTTPS certificates, refuse redirects and do not retry. Local HTTP remains
The skill explicitly requires environment variables and network access to a live Home Assistant instance, but it does not declare any explicit tool scope or allowed-tools boundary in the skill manifest. That increases the chance an agent can invoke broader capabilities than intended, especially in a skill that handles bearer tokens and can perform device-affecting API calls.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# List all areas
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/template" \
-H @- \
-H "Content-Type: application/json" \
-d '{"template": "{{ areas() }}"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Turn on
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/services/switch/turn_on" \
-H @- \
-H "Content-Type: application/json" \
-d '{"entity_id": "switch.office_lamp"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"entity_id": "switch.office_lamp"}'
# Turn off
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/services/switch/turn_off" \
-H @- \
-H "Content-Type: application/json" \
-d '{"entity_id": "switch.office_lamp"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"entity_id": "switch.office_lamp"}'
# Toggle
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/services/switch/toggle" \
-H @- \
-H "Content-Type: application/json" \
-d '{"entity_id": "switch.office_lamp"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Turn on with brightness
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/services/light/turn_on" \
-H @- \
-H "Content-Type: application/json" \
-d '{"entity_id": "light.living_room", "brightness_pct": 80}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Turn on with brightness
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/services/light/turn_on" \
-H @- \
-H "Content-Type: application/json" \
-d '{"entity_id": "light.living_room", "brightness_pct": 80}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Turn on with brightness
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/services/light/turn_on" \
-H @- \
-H "Content-Type: application/json" \
-d '{"entity_id": "light.living_room", "brightness_pct": 80}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Turn on with brightness
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/services/light/turn_on" \
-H @- \
-H "Content-Type: application/json" \
-d '{"entity_id": "light.living_room", "brightness_pct": 80}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"entity_id": "light.living_room", "color_temp_kelvin": 3333}'
# Turn off
printf 'Authorization: Bearer %s\n' "$HA_TOKEN" | curl -q -fsS --noproxy '*' --connect-timeout 5 --max-time 30 -X POST "$HA_URL/api/services/light/turn_off" \
-H @- \
-H "Content-Type: application/json" \
-d '{"entity_id": "light.living_room"}'
No suspicious patterns detected.