Netatmo

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is coherent for Netatmo control, but users should notice that it relies on a separate CLI, local OAuth tokens, and can change thermostat settings.

Install only if you trust the separate `netatmo` CLI and are comfortable letting the agent read Netatmo sensor data and control thermostat settings through your local OAuth tokens. Protect the token files and request confirmation for temperature or mode changes if unintended heating changes would matter.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

If invoked unintentionally, the agent could change heating temperature or mode.

Why it was flagged

These commands can change the physical thermostat state. The behavior is disclosed and aligned with the skill purpose, with some bounds documented.

Skill content

netatmo set 21              # Set target temp (7-30°C, 3h manual mode)
netatmo mode away           # Away mode (12°C)
netatmo mode hg             # Frost guard (7°C)

Recommendation

Use thermostat-changing commands only when you explicitly want a change, and consider asking the agent to confirm before running `set` or `mode` commands.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or any process with access to those token files may be able to read Netatmo data or control devices through the same account.

Why it was flagged

The skill expects local Netatmo OAuth credentials and tokens. This is appropriate for a Netatmo integration, but it grants access to the user's Netatmo account and devices.

Skill content

Credentials in `~/.config/netatmo/`:
- `credentials.json`: `{"client_id": "...", "client_secret": "..."}`
- `tokens.json`: OAuth tokens (auto-refreshed)

Recommendation

Protect `~/.config/netatmo/`, use only appropriately scoped Netatmo credentials, and do not share token files.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The safety of actions depends partly on which `netatmo` command-line tool is installed on the user's system.

Why it was flagged

The skill depends on an external `netatmo` CLI, while the provided artifact set has no install spec or declared required binary. This is not inherently unsafe, but users must know and trust the CLI being invoked.

Skill content

Control Netatmo smart home devices via `netatmo` CLI.

Recommendation

Install the Netatmo CLI from a trusted source and verify the binary in your PATH before using the skill.