Lofy Home

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:08 PM UTC
• Version: 1.0.0

Overview

This smart-home skill is purpose-aligned, but it needs review because it can change physical home state with ambiguous commands and documents sending a Home Assistant bearer token over HTTP.

Review before installing. Use HTTPS or a tightly isolated local network, create a least-privilege Home Assistant token, and require explicit confirmation for thermostat changes, presence-based automations, broad scenes, and Wake-on-LAN. Avoid enabling casual trigger phrases unless the agent reliably asks before changing devices.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23

Finding

Home Assistant Bearer Token Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23 and 38-51
Vulnerability Type: Plaintext transmission of sensitive authentication credentials
Risk Level: High

The documented Home Assistant configuration uses an unencrypted HTTP endpoint:

json

"home_assistant": { "url": "http://homeassistant.local:8123", "token_env": "HA_TOKEN" }

The API examples send the Home Assistant bearer token to that endpoint:

bash

# Light control
curl -s -X POST "$HA_URL/api/services/light/turn_on" \
  -H "Authorization: Bearer $HA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"entity_id": "light.desk_lamp", "brightness_pct": 100}'

# Media playback
curl -s -X POST "$HA_URL/api/services/media_player/play_media" \
  -H "Authorization: Bearer $HA_TOKEN" \
  -d '{"entity_id": "media_player.speaker", "media_content_id": "spotify:playlist:xxx", "media_content_type": "playlist"}'

# Wake-on-LAN
curl -s -X POST "$HA_URL/api/services/wake_on_lan/send_magic_packet" \
  -H "Authorization: Bearer $HA_TOKEN" \
  -d '{"mac": "XX:XX:XX:XX:XX:XX"}'

Technical Analysis

HTTP does not provide transport encryption, server authentication, or integrity protection. When the documented http://homeassistant.local:8123 endpoint is used, the Authorization: Bearer $HA_TOKEN header is transmitted in plaintext.

An attacker with visibility into or control over the relevant network path could inspect requests, recover the bearer token, or modify service requests in transit. Because bearer tokens grant access based on possession, an intercepted token can be replayed without knowledge of another secret. The resulting access is limited by the Home Assistant permissions associated with that token.

Attack Path

1. A user configures the Skill using the documented plaintext Home Assistant URL.
2. The Skill invokes a Home Assistant service and includes Authorization: Bearer $HA_TOKEN.
3. A network-po ...[truncated 1038 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the documented HTTP endpoint with an HTTPS endpoint protected by a valid TLS certificate.
2. Verify TLS certificates and hostnames; do not use options that disable certificate validation.
3. Validate HA_URL before sending credentials and reject plaintext HTTP endpoints by default.
4. If plaintext HTTP must be supported for isolated development, restrict it to an explicit opt-in mode and preferably to loopback-only communication.
5. Create a dedicated Home Assistant credential with only the minimum permissions required for the supported device operations.
6. Ensure command output, debugging logs, and error messages never record the bearer token or complete authorization header.
7. Revoke and rotate any token that may previously have been transmitted across an untrusted network.
8. Consider network segmentation and firewall rules that restrict Home Assistant API access to trusted clients.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill performs networked control of lights, media devices, and Wake-on-LAN-capable systems but does not prominently warn that commands can change physical environment state or power on devices. In the context of home automation, users may not appreciate the consequences of casual phrasing, increasing the likelihood of unsafe or surprising actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

bash

# Light control
curl -s -X POST "$HA_URL/api/services/light/turn_on" \
  -H "Authorization: Bearer $HA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"entity_id": "light.desk_lamp", "brightness_pct": 100}'

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-command phrases include common conversational language such as "it's cold," "I'm home," and "I'm heading out," which can be triggered during ordinary dialogue rather than an intentional home-control request. In a smart-home skill, this creates a real risk of unintended physical-world actions like changing thermostat settings, altering lighting, or activating automations without clear user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The instruction flow implies actions are executed first and only then confirmed, enabling autonomous smart-home changes without an explicit approval step for many commands. In this context, autonomous execution is more dangerous because it affects physical devices, presence-related behavior, and potentially powers on a PC via Wake-on-LAN.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

1. Read `data/home-config.json` for device mappings and scenes
2. Confirm actions in ONE short message
3. If a device fails, report which one and suggest a fix
4. Never execute "turn off all devices" without confirmation
5. If Home Assistant is unreachable, report and suggest checking connection
6. Device entity_ids must be configured by user — prompt if missing

Static analysis

No suspicious patterns detected.