🏡 Home Assistant Builder (hab)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 1.0.1

Overview

The skill fits its Home Assistant purpose, but it automatically downloads and runs a changing, unverified external CLI while using Home Assistant credentials.

Review this skill before installing. It is intended for real Home Assistant administration and can change or delete resources, restart systems, and affect devices. The main risk is that its wrapper installs a mutable GitHub latest binary without integrity verification; use it only if you trust that upstream release path and are comfortable exposing HAB_TOKEN/HAB_URL to the downloaded CLI. Prefer a pinned, checksum-verified release before using it for sensitive or destructive operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/hab.sh:5

Finding

Unpinned and Unverified Remote Binary Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/hab.sh, lines 5–6 and 62–74
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The wrapper downloads the current latest release binary from GitHub and executes it without pinning a version or verifying its checksum, signature, or provenance.

bash

REPO="balloob/home-assistant-build-cli"
BASE_URL="https://github.com/${REPO}/releases/latest/download"

bash

url="${BASE_URL}/${filename}"
echo "Downloading hab (${os}/${arch})..."

local tmp_file
tmp_file="${CACHE_DIR}/.download-${filename}"

if download "${url}" "${tmp_file}" && [ -s "${tmp_file}" ]; then
    chmod +x "${tmp_file}"
    mv -f "${tmp_file}" "${binary_path}"
else
    rm -f "${tmp_file}"
    echo "Error: download failed from ${url}" >&2
    exit 1
fi

The downloaded file is subsequently executed at scripts/hab.sh:77:

bash

exec "${binary_path}" "$@"

Technical Analysis

The URL uses the mutable GitHub releases/latest endpoint, so the executable retrieved at runtime can change after the Skill has been reviewed. The only integrity check is [ -s "${tmp_file}" ], which confirms merely that the file is nonempty. It does not establish that the file is an approved release artifact.

HTTPS protects the transfer in transit but does not protect against compromise of the upstream repository, release workflow, maintainer credentials, or release assets. If any of those controls are compromised, an attacker can replace the expected platform artifact with arbitrary executable code. The wrapper then grants executable permission and runs that payload automatically.

This behavior is particularly sensitive because SKILL.md requires users and agents to replace normal hab commands with this wrapper. The resulting process can inherit HAB_TOKEN, HAB_URL, and other environment variables.

Attack Path

1. An attacker co ...[truncated 1652 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an audited release version. Replace the mutable latest endpoint with an explicit, reviewed release tag.
2. Verify artifact integrity. Store trusted SHA-256 digests for every supported OS and architecture in the Skill, and verify the downloaded artifact before granting executable permission or moving it into the cache.
3. Verify authenticity and provenance. Validate a cryptographic release signature or supported build-provenance attestation in addition to checking a digest.
4. Fail closed. Delete the downloaded file and abort if any digest, signature, filename, file-type, or provenance check fails.
5. Use secure temporary-file handling. Create temporary files with mktemp in a directory accessible only to the current user, and reject symbolic links or unexpected file types before installation.
6. Require approval for installation and upgrades. Clearly display the pinned version, source URL, and expected digest, then request explicit approval before the first download or any version change.
7. Limit credential exposure. Avoid exposing unrelated environment variables to the downloaded process. Where feasible, pass only the variables required for legitimate CLI operation.
8. Document controlled updates. Upgrade the pinned version only through a review process that verifies the source, release artifacts, checksums, and behavior of the new binary.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill explicitly instructs the agent to run shell commands via a wrapper script and perform state-changing Home Assistant operations, but it does not declare any tool scope restrictions such as allowed tools or permissions. That creates a privilege-boundary problem: an agent may invoke shell access for this skill without an explicit least-privilege contract, increasing the chance of unintended command execution, environment secret exposure, or misuse of HAB_TOKEN/HAB_URL in a broader shell context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation text is broad enough to trigger on general Home Assistant topics such as dashboards, automations, backups, ESPHome, or terminal operations, not only when the user clearly intends to use this CLI skill. Over-broad matching can route benign conversational requests into a shell-capable skill, unnecessarily exposing command execution paths and increasing the risk of accidental destructive guidance or secrets-handling in the wrong context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.