Home Assistant

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:07 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and not malicious, but it can give an agent broad, real-world control over a Home Assistant instance without built-in guardrails.

Install only if you are comfortable letting the agent control your Home Assistant devices and automations. Use a dedicated least-privilege token if possible, restrict the config file to owner-only access, rotate tokens when needed, and avoid the generic service caller for locks, alarms, doors, covers, climate, cameras, scripts, or other sensitive actions unless you explicitly intend that action.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill clearly instructs use of shell commands (`curl`, `jq`, and `ha.sh`) that can perform live actions against a Home Assistant instance, yet no explicit permission model is declared. That creates a gap between what the skill can do and what a user or host system may expect, increasing the risk of unintended command execution against sensitive home-automation infrastructure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior goes beyond the high-level description by enabling arbitrary service invocation through a generic `call` command and broad enumeration/search of entities, while also claiming inbound webhook support without showing any actual receiving or validation logic. This mismatch is dangerous because users may grant trust based on a narrower description, while the skill can trigger any exposed Home Assistant service, potentially unlocking doors, opening covers, or running high-impact automations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The `call` subcommand allows arbitrary Home Assistant service invocation, which goes beyond the narrower skill description of controlling common entity types and automations. In Home Assistant, service calls can perform far more sensitive actions than simple light or climate control, including administrative, destructive, or security-relevant operations, so exposing a generic passthrough materially expands capability and risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This skill is designed to control physical devices and trigger automations, but it provides no user-facing warning that actions may affect the real-world environment. In the Home Assistant context, service calls can operate lights, climate, covers, garage doors, or other actuators, so missing safety disclosure increases the chance of unsafe or unintended physical effects.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The webhook section instructs users to transmit Home Assistant event data to an external Clawdbot endpoint but does not clearly warn that home activity metadata leaves the local HA environment. Event names, areas, and future payload expansions can reveal occupancy patterns or other sensitive household information, and the example uses bearer authentication without discussing secret management or exposure risks.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document provides detailed instructions for authenticated state-changing operations, event firing, webhook triggering, and real-time access without any safety guidance, authorization scoping discussion, or warnings about physical-world effects and data exposure. In a Home Assistant skill, these capabilities can control locks, garage doors, climate, media, and notifications, so omission of operational safeguards materially increases the risk of unsafe or over-privileged integrations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The generic `call` path submits attacker- or user-supplied JSON directly to any Home Assistant service without any confirmation, policy checks, or safety interlocks. Because Home Assistant services may unlock doors, disable alarms, open covers, modify persistent configuration, or invoke integrations with external side effects, this can trigger irreversible or security-sensitive actions unexpectedly.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.