T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ha.sh:20- Finding
Long-Lived Home Assistant Bearer Token Can Be Transmitted Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 ;; esac ``` ]]>
Security audit
Home Assistant Backup
Security checks for vulnerabilities and agentic risk
Overview
This Home Assistant skill is purpose-aligned but gives broad smart-home control using long-lived bearer tokens with weak transport and storage guidance.
Install only if you are comfortable giving this skill broad Home Assistant control. Use HTTPS or trusted local-only transport, protect the token like a password, restrict config file permissions, prefer a dedicated least-privilege Home Assistant account, and be cautious with the generic service-call command, webhooks, covers, climate, scripts, and automations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:15- Finding
Recommended Configuration Stores a Long-Lived Token Without Permission Hardening
- Content
View full analysis
- Remediation
View remediation
"$HOME/.config/home-assistant/config.json" chmod 600 "$HOME/.config/home-assistant/config.json" ``` 2. At runtime, verify that the configuration file: - Is owned by the current user. - Is a regular file rather than an unexpected symbolic link. - Is not readable or writable by group or other users. 3. Fail closed with a clear error when unsafe ownership or permissions are detected. 4. Advise users not to commit, synchronize, log, or include the file in broadly accessible backups. 5. Recommend a dedicated, least-privileged Home Assistant account and regular token rotation. 6. Prefer an operating-system credential store or secret manager where available. 7. Revoke the token immediately if the configuration file may have been exposed. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior claims bidirectional communication including inbound webhooks, but the file only documents outbound API usage and an example webhook configuration without implementing a receiver. It also exposes broader capabilities such as entity enumeration and arbitrary service invocation, which materially expand what the skill can do beyond the stated purpose and can enable unexpected or unsafe home-automation actions.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
export HA_TOKEN="your-long-lived-access-token"
text ### Getting a Long-Lived Access Token 1. Open Home Assistant → Profile (bottom left) 2. Scroll to "Long-Lived Access Tokens"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Getting a Long-Lived Access Token 1. Open Home Assistant → Profile (bottom left) 2. Scroll to "Long-Lived Access Tokens" 3. Click "Create Token", name it (e.g., "Clawdbot") 4. Copy the token immediately (shown only once)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh Environment: HA_URL Home Assistant URL (required) HA_TOKEN Long-lived access token (required) Examples: ha.sh on light.living_room 200
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill exposes shell-based capabilities via curl/jq examples and a referenced CLI wrapper but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, undocumented shell access increases the risk of overbroad execution and unintended command use, especially for a skill that can control physical devices.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill provides direct commands for lights, covers, climate, scripts, and automations without warning that these actions can have real-world, potentially safety-critical effects. In the smart-home context, triggering doors, HVAC, or automations without caution or confirmation can cause physical security, privacy, or safety issues.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The recommended configuration stores a long-lived access token in a plaintext file under the user's home directory, creating persistent credential exposure if filesystem permissions, backups, or local compromise are not tightly controlled. Because the token can control smart-home devices and automations, theft could enable unauthorized observation or physical-world actions.
- Content
Option 1: Config File (Recommended)
Create
~/.config/home-assistant/config.json:json { "url": "https://your-ha-instance.duckdns.org",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get Entity State
bash curl -s -H "Authorization: Bearer $HA_TOKEN" "$HA_URL/api/states/light.living_room"Control Devices
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The webhook section instructs users to send home event data to an external endpoint but omits privacy and security warnings about what data is being transmitted and how it should be protected. Home presence, motion, and area data can reveal occupancy patterns and sensitive household behavior if exposed or sent to an untrusted destination.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation shows use of a long-lived access token but does not warn that it is effectively a bearer secret that grants control over Home Assistant. In the context of a smart-home control skill, omission of token-handling guidance increases the chance that users expose the token in logs, examples, screenshots, or insecure transport, enabling unauthorized control of devices and access to home-state data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The reference normalizes state-changing API calls without warning that they can affect physical devices and home security posture, such as unlocking/operating covers, changing climate settings, or sending notifications. In a Home Assistant skill, this can lead users or downstream agents to invoke powerful actions without appropriate confirmation, authorization checks, or awareness of real-world consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The webhook documentation omits that the webhook ID functions like a bearer secret: anyone who knows it can trigger the associated automation. Because webhook-triggered automations may control devices or execute workflows, accidental disclosure of the webhook ID can enable unauthorized actions against the home environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The WebSocket example uses
ws://and shows sending an access token without warning to use secure transport, which could expose the bearer token to interception on untrusted networks. Since that token can authenticate to Home Assistant and subscribe to sensitive events or control devices via associated APIs, compromise can impact both privacy and physical security.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The
callcommand allows arbitrary Home Assistant domain/service invocation with attacker-controlled JSON, which bypasses the otherwise scoped device-control operations exposed elsewhere in the script. In the context of a smart-home skill, this can be used to trigger any HA service the token is authorized for, including sensitive automations, notifications, scripts, locks, alarms, or admin-like actions reachable through HA integrations.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code exposes unrestricted Home Assistant service execution without meaningful guardrails, while the skill description suggests concrete smart-home controls rather than full HA API/service administration. Because Home Assistant service calls can reach far beyond lights/climate/scenes, this creates a capability escalation surface where any caller of the script can perform broad actions under the bearer token's authority.
- Content
Static analysis
No suspicious patterns detected.