Security audit

Home Assistant Assist

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it gives an agent broad smart-home control using a long-lived token and an unsafe shell command pattern that needs review before installation.

Review this skill before installing. Use a dedicated Home Assistant token with the least access available, protect the OpenClaw config file, prefer HTTPS for HASS_SERVER, and avoid using it for locks, alarms, garage doors, or other high-risk devices unless you add confirmation and safe request serialization.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:27
Finding: Shell Command Injection Through Unsafe User Request Interpolation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 30)May include surrounding context.
md
- [OpenClaw](https://github.com/openclaw/openclaw) installed and running - Home Assistant instance with API access - A [Long-Lived Access Token](https://developers.home-assistant.io/docs/auth_api/#long-lived-access-token) from Home Assistant ## Installation

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 68)May include surrounding context.
md
1. Open Home Assistant 2. Click your profile (bottom left) 3. Scroll to **Long-Lived Access Tokens** 4. Click **Create Token** 5. Give it a name (e.g., "OpenClaw") 6. Copy the token immediately (it won't be shown again!)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
1. Open Home Assistant 2. Click your profile (bottom left) 3. Scroll to **Long-Lived Access Tokens** 4. Click **Create Token** 5. Give it a name (e.g., "OpenClaw") 6. Copy the token immediately (it won't be shown again!)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users to place a long-lived Home Assistant token directly into a local configuration file without any warning about credential sensitivity, least-privilege, filesystem protections, or secret-management practices. Because this token can control smart home devices and query home state, accidental exposure through backups, screenshots, shared configs, or weak file permissions could enable unauthorized access to the user's Home Assistant environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is designed to trigger real smart-home actions but explicitly promotes a 'fire and forget' model without requiring a confirmation or warning before sending control commands. In this context, natural-language home automation can unlock doors, disable alarms, or manipulate safety-relevant devices, so lack of a warning/confirmation increases the chance of unintended or unsafe actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The skill forwards raw user requests to an external Home Assistant server along with a bearer token, which is an external transmission of potentially sensitive home-behavior data. In this context the transmission is core to the skill's purpose, but it still carries privacy and security risk because user utterances may reveal occupancy, routines, device names, or security-sensitive intents.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
Pass the user's request directly to Assist:

bash
curl -s -X POST "$HASS_SERVER/api/conversation/process" \ -H "Authorization: Bearer $HASS_TOKEN" \ -H "Content-Type: application/json" \ -d '{"text": "USER REQUEST HERE", "language": "en"}'

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill hard-codes the request language to English when forwarding user commands to Home Assistant. This can cause misinterpretation of non-English or multilingual requests, and in a smart-home control context, intent confusion can result in the wrong physical device being operated or an action occurring contrary to user expectation.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · CHANGELOG.md (reported line 42)May include surrounding context.
md
## [1.0.1] - 2026-02-07 ### Changed - Simplified skill philosophy: "fire and forget" — trust Assist to handle everything - Removed over-engineered response parsing guidance - Errors from Assist are now framed as HA config suggestions, not skill failures - Streamlined documentation

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The request schema example specifies "language": "en" as the fixed value, which signals that the skill is intended to operate only in English. Without user opt-in or documentation explaining the locale restriction, this conflicts with the language/locale policy guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.