Home Assistant Master

Home Assistant OS (HAOS) operations skill for OpenClaw agents. Use for read-only audits, diagnostics, automation design/review, dashboard UX planning, voice...

Security Scan

The skill is internally consistent: an instruction-only, read-first Home Assistant operations assistant that requests no unrelated credentials or installs and explicitly gates writes behind confirmation.

Purpose & Capability

Name/description (HAOS operations, audits, diagnostics, automation design) match the SKILL.md and reference docs. The skill requests no unrelated binaries, env vars, or configs; it explicitly expects platform-provided runtime access (connector/browser relay/token), which is appropriate for this purpose.

Instruction Scope

Runtime instructions stay on-purpose: emphasize read-only diagnostics, evidence collection (states/history/logs/traces) and only perform writes after explicit multi-step confirmation. The SKILL.md lists allowed vs blocked actions and tiered risk controls; reading potentially sensitive logs is expected for diagnostics and is explicitly constrained by the policy.

Install Mechanism

Instruction-only skill with no install spec and no code files — nothing is downloaded or written to disk by the skill itself, minimizing installation risk.

Credentials

Skill declares no required environment variables or credentials. It documents acceptable runtime access methods and credential handling policies (avoid pasting long-lived secrets, use secret storage), which is proportional to its needs. The platform/host will supply any needed tokens; users should ensure least-privilege tokens are used.

Persistence & Privilege

always:false (default) and no persistent install behavior. disable-model-invocation is false (agent may invoke autonomously) — this is the platform default and not combined with other red flags in this skill.

Assessment

This skill appears coherent and conservative, but it requires the hosting platform to provide access to your Home Assistant instance. Before installing or enabling it: (1) verify the hosting agent/connector is trusted and inspect its connector implementation if possible; (2) do not paste long-lived tokens into chat—use the platform's secret storage or short-lived, least-privilege tokens (read-only tokens for audits); (3) require explicit confirmation for any write actions and prefer two-step confirmation for sensitive changes; (4) audit agent activity and logs after first runs to ensure no unexpected data exfiltration; (5) if you need stronger guarantees, restrict the agent to read-only access or review the platform's permission model before granting runtime write capabilities.

Follow a diagnostics-first, safety-first workflow for HAOS.

Core operating policy

1. Start read-only (state/history/logs/traces/diagnostics).
2. Confirm runtime access path and credential handling policy before operational guidance.
3. Preview exact impact before any write.
4. Ask explicit confirmation before writes.
5. Verify outcome and summarize results.

Risk controls

• Tier 0: read-only (safe by default).
• Tier 1: low-risk writes (lights/helpers/scenes/scripts).
• Tier 2: sensitive writes (locks/alarms/garage/cameras/access).
• Tier 3: platform actions (restart/reload/update/restore).
• Require two-step confirmation for Tier 2/3.

Execution workflow

1. Clarify user intent + constraints.
2. Collect evidence (trace/history/logs/integration state).
3. Diagnose root cause (or design options if planning).
4. Return smallest safe next step first.
5. Expand only if user asks (checklist -> deep dive).

Reference map (load only when needed)

• references/safety-policy.md
• references/workflows.md
• references/checklists.md
• references/citations.md
• references/model-codex.md
• references/model-claude.md
• references/release-watch.md
• references/home-agent-profile.md
• references/access-and-credentials.md

Allowed actions (default)

• Read-only diagnostics: states, history, traces, logs, integration health.
• Planning outputs: checklists, decision trees, change previews.
• Low-risk guidance for dashboards/automations/helpers without executing writes.

Blocked actions (without explicit approval)

• Any write/reload/restart/update/restore action.
• Any lock/alarm/camera/access-control changes.
• Any bulk entity/service mutation beyond explicitly scoped targets.
• Any instruction to reveal or move secrets/tokens.

Hard constraints

• Never execute destructive/mass changes without explicit scoped approval.
• Never disable security controls as a shortcut.
• Prefer official HA docs when guidance conflicts.