Security audit

Homeassistant Mcp

Security checks for vulnerabilities and agentic risk

Overview

This Home Assistant skill needs review because it handles powerful smart-home access tokens and private camera data through hard-coded, plaintext shell commands.

Only install this if you intentionally trust the fixed Home Assistant endpoint, understand that a long-lived token may be passed through shell commands over HTTP, and are comfortable with camera snapshots and entity mappings being read or written in the workspace. Prefer a version that uses user-configured HTTPS endpoints, scoped credentials, native MCP tools, and explicit handling for saved images.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:7
Finding: Long-Lived Access Token Transmitted to a Hard-Coded Endpoint over Plaintext HTTP
Content: View full analysis
" "http://220.0.0.5:8123/api/camera_proxy/camera." -o /home/clawd/.openclaw/workspace/.jpg` ``` ```markdown - If MCP tools timeout, fallback to the REST API: `curl -H "Authorization: Bearer " http://220.0.0.5:8123/api/states/` ``` ### Technical Analysis The Skill instructs the Agent to transmit a Home Assistant long-lived bearer token to the hard-coded IP address `220.0.0.5` using unencrypted HTTP. Because HTTP does not provide transport confidentiality or endpoint authentication, the authorization header, requested entity identifiers, camera images, and Home Assistant responses may be observed or modified by the destination operator or an attacker positioned on the network path. A bearer token grants access based solely on possession. Any party that captures the token can reuse it until it is revoked or expires. The declared integration does not require a fixed external IP address: a generic Home Assistant Skill should obtain its endpoint from explicit user configuration and should use authenticated HTTPS. Consequently, the hard-coded destination and plaintext token transmission exceed the minimum privileges and network exposure required for the declared functionality. The use of `exec` and `curl` also bypasses protections that may exist in the native MCP integration, including endpoint restrictions, credential isolation, and structured authorization controls. ### Attack Path 1. A user installs or activates the Skill and configu ...[truncated 1403 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:30
Finding: Unnecessary Access to Persistent Agent Memory Outside the Skill Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.
md
## Credentials The MCP server endpoint is `http://220.0.0.5:8123/api/mcp`. Ensure the connection is configured with the correct Long-Lived Access Token. ## Best Practices

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill presents itself as using Home Assistant's native MCP integration, but then directs the agent to avoid broken MCP camera tooling and fall back to REST via exec. That mismatch encourages security-boundary bypasses and undermines assumptions that interactions stay within audited MCP controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to bypass the intended MCP interface and use arbitrary shell execution with curl against Home Assistant APIs. This expands the attack surface from constrained tool use to general command execution, increases the chance of token leakage in command lines or logs, and enables filesystem writes of sensitive camera images.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instructions normalize passing a bearer token to curl and writing camera snapshots to a fixed local path without safeguards. This can expose credentials via shell history, process inspection, logs, or prompt artifacts, while persisting sensitive home imagery on disk where other processes or users may access it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 62% confidence
Finding: This line gives a mandatory presentation instruction ('display it using the MEDIA:<path> directive') rather than offering a user choice in how results are returned. While not a language policy issue, it is a natural-language constraint embedded in the skill instructions that may override user preference for output format.
Content: No source excerpt is available for this finding.