Moltbot Home Assistant

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:34 AM UTC
• Version: 0.1.1

Overview

The skill is coherent, but it asks users to install an unpinned external smart-home control tool and use long-lived Home Assistant credentials with plaintext HTTP examples.

Review this skill before installing. Use a dedicated least-privilege Home Assistant account/token, prefer HTTPS or a trusted local-only boundary, avoid safety levels 0 and 1 for agent use, set an allowlist for permitted entities, and install only a reviewed/pinned moltbot-ha release if possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:6

Finding

Unpinned External Package Executes with Access to Home Assistant Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:6, SKILL.md:14-16, and README.md:24-35
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: High

Vulnerable Code

SKILL.md:6:

yaml

metadata: {"moltbot":{"emoji":"🏠","requires":{"bins":["moltbot-ha"],"env":["HA_TOKEN"]},"primaryEnv":"HA_TOKEN","install":[{"id":"uv","kind":"uv","package":"moltbot-ha","bins":["moltbot-ha"],"label":"Install moltbot-ha (uv tool)"}]}}

SKILL.md:14-16:

bash

uv tool install moltbot-ha

README.md:24-35:

bash

uv tool install moltbot-ha

bash

pip install moltbot-ha

bash

git clone https://github.com/iamvaleriofantozzi/moltbot-ha.git
cd moltbot-ha
uv tool install .

Technical Analysis

The Skill instructs users and agents to install moltbot-ha from a mutable external package registry or repository without specifying an exact version, immutable commit, package hash, signature, or lockfile. The audited artifact contains only documentation and configuration; it does not contain the executable implementation. Therefore, the installed package's credential handling, safety checks, service-call validation, and logging behavior cannot be verified from this artifact.

The metadata explicitly grants the installed executable access to HA_TOKEN. A package-registry compromise, maintainer-account compromise, malicious replacement release, or unexpected incompatible update could therefore execute arbitrary package code in the user's environment while inheriting a reusable Home Assistant credential.

Attack Path

1. An attacker compromises the package registry entry, release process, maintainer credentials, or referenced repository.
2. The attacker publishes a modified moltbot-ha package under the same mutable package name.
3. A user or agent follows the documented uv tool install moltbot-ha or pip install moltbot-ha instruction.
4. The pa ...[truncated 1139 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version, such as moltbot-ha==X.Y.Z.
2. Require cryptographic hash verification for downloaded distributions and publish expected hashes through a separately protected channel.
3. Include a lockfile that resolves every transitive dependency to an exact version and integrity digest.
4. Reference source installations by an immutable commit hash rather than a mutable branch or tag.
5. Include the corresponding CLI source in the audited artifact, or provide verifiable provenance connecting the package artifact to reviewed source.
6. Sign releases and verify signatures before installation.
7. Use automated dependency monitoring and reproducible builds.
8. Run the CLI under a dedicated, restricted operating-system account or container.
9. Issue a dedicated, minimally privileged Home Assistant credential and rotate it if package integrity is ever uncertain.
10. Prevent the dependency from accessing unrelated environment variables, files, and network destinations through sandboxing or an explicit execution policy.

T09 · Insecure Skill Coding Practices

Error

• Location: config.example.toml:6

Finding

Long-Lived Home Assistant Credentials May Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: config.example.toml:6-11, SKILL.md:23, SKILL.md:249-250, README.md:48, README.md:78, README.md:218, and README.md:257
Vulnerability Type: Plaintext transmission of reusable authentication credentials
Risk Level: High

Vulnerable Code

config.example.toml:6-11:

toml

# Examples:
#   - Local: http://192.168.1.100:8123
#   - mDNS: http://homeassistant.local:8123
#   - Tailscale: http://homeassistant.ts.net:8123
#   - Nabu Casa: https://xxxxx.ui.nabu.casa
url = "http://homeassistant.local:8123"

SKILL.md:249-250:

toml

[server]
url = "http://homeassistant.local:8123"

README.md:78:

bash

export HA_URL="http://192.168.1.100:8123"
export HA_TOKEN="your_token_here"
moltbot-ha config init --no-interactive
moltbot-ha test

README.md:257:

text

- **IP address** (recommended): `http://192.168.1.100:8123`
- **Tailscale**: `http://homeassistant.ts.net:8123`
- **Avoid mDNS** in Docker: `homeassistant.local` often doesn't work
- **Nabu Casa**: `https://xxxxx.ui.nabu.casa` (requires subscription)

Technical Analysis

The example configuration defaults to an unencrypted http:// endpoint, and the documentation explicitly recommends a plaintext IP-address URL. The CLI authenticates using a Home Assistant long-lived access token. When bearer-style credentials and API requests are sent over HTTP, the transport provides neither confidentiality nor cryptographic server authentication.

An attacker capable of observing or modifying traffic on the relevant network path could potentially capture the reusable token, inspect entity information, replay authenticated requests, alter service calls, or impersonate the Home Assistant endpoint. Storing the token in an environment variable does not mitigate exposure while it is transmitted over an unencrypted connection.

The risk applies especially to shared Wi-Fi, ...[truncated 1508 chars]

Remediation

View remediation

Remediation Suggestions

1. Change all defaults and recommended examples to https:// endpoints.
2. Reject plaintext HTTP by default in the CLI, with any exception requiring an explicit, prominently warned local-development option.
3. Configure Home Assistant or a trusted reverse proxy with TLS using a certificate valid for the configured hostname.
4. Enforce certificate and hostname validation; do not recommend disabling TLS verification.
5. For private deployments, use a trusted internal certificate authority and install its root certificate securely on the CLI host.
6. If a VPN such as Tailscale is used, prefer HTTPS within the tunnel as defense in depth.
7. Use a dedicated Home Assistant account or credential with the minimum permissions required for intended entities and actions.
8. Revoke and rotate any long-lived token that may previously have traversed an untrusted plaintext connection.
9. Consider short-lived credentials or an authenticated local proxy where supported.
10. Add automated configuration validation that warns or fails when a non-loopback http:// URL is supplied.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 319)May include surrounding context.

md

### 401 Unauthorized
- Verify `HA_TOKEN` is set correctly
- Ensure token is a **Long-Lived Access Token** (not temporary)
- Check token hasn't been revoked in Home Assistant

### Entity Not Found

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

### 401 Unauthorized
- Verify `HA_TOKEN` is set correctly
- Ensure token is a **Long-Lived Access Token** (not temporary)
- Check token hasn't been revoked in Home Assistant

### Entity Not Found

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 253)May include surrounding context.

md

#   - Nabu Casa: https://xxxxx.ui.nabu.casa
url = "http://homeassistant.local:8123"

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

#   - Nabu Casa: https://xxxxx.ui.nabu.casa
url = "http://homeassistant.local:8123"

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.example.toml (reported line 13)May include surrounding context.

toml

#   - Nabu Casa: https://xxxxx.ui.nabu.casa
url = "http://homeassistant.local:8123"

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

md

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

[safety]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

[safety]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config.example.toml (reported line 15)May include surrounding context.

toml

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

[safety]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The README explicitly documents a safety mode where confirmations can be disabled or reduced, including 'No safety checks' and a recommended mode that confirms only critical operations. In an agent-operated smart home context, this can enable autonomous state-changing actions without human approval, increasing the chance of unsafe or unauthorized physical-world actions such as unlocking, opening covers, or activating devices.

Content

Scanner excerpt · README.md (reported line 145)May include surrounding context.

md

| Level | Behavior |
|-------|----------|
| 0 | No safety checks (⚠️ dangerous!) |
| 1 | Log actions only, no confirmations |
| 2 | Confirm all write operations |
| 3 | Confirm critical operations only (🏅 **recommended**) |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

export HA_TOKEN="your_token_here"

text

To create a token:
1. Open Home Assistant → Profile (bottom left)
2. Scroll to "Long-Lived Access Tokens"
3. Click "Create Token"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · config.example.toml (reported line 15)May include surrounding context.

toml

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

[safety]

Static analysis

No suspicious patterns detected.