Home Assistant Master

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.0.3

Overview

This is an instruction-only Home Assistant operations skill that is read-first and clearly approval-gated for sensitive actions.

Before installing, ensure any Home Assistant connector or token is least-privilege and stored only in platform secret storage. Treat device, lock, alarm, camera, restart, update, restore, and backup actions as high-impact and require the confirmation steps the skill describes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.

md

---
name: home-assistant-master
description: Home Assistant OS (HAOS) operations skill for OpenClaw agents. Use for read-only audits, diagnostics, automation design/review, dashboard UX planning, voice intent mapping, integration risk assessment, backup/restore readiness checks, and maintenance playbooks. Default to read-only; require explicit approval before any write/reload/restart. Apply when users ask to troubleshoot entities/devices/integrations, improve reliability, design automations, or plan safe Home Assistant changes.
---

# Home Assistant Master

Follow a diagnostics-first, safety-first workflow f

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/access-and-credentials.md (reported line 12)May include surrounding context.

md

3. A platform-approved secure token flow.

## Credential handling policy
- Never ask users to paste long-lived secrets in public/group chats.
- Store credentials only in platform secret storage (never in skill files).
- Use least-privilege scopes/tokens where possible.
- Mask/redact sensitive values in output.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The profile sets a default voice target as a "warm woman voice," which imposes a specific voice/persona characteristic in natural language without indicating user choice or opt-in. The policy for this category requires flagging forced language/locale-style constraints when they are not optional or user-selectable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.