Moltbot Home Assistant

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:34 AM UTC
• Version: 0.1.1

Overview

The skill is coherent, but it asks users to install an unpinned external smart-home control tool and use long-lived Home Assistant credentials with plaintext HTTP examples.

Review this skill before installing. Use a dedicated least-privilege Home Assistant account/token, prefer HTTPS or a trusted local-only boundary, avoid safety levels 0 and 1 for agent use, set an allowlist for permitted entities, and install only a reviewed/pinned moltbot-ha release if possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:6
• Finding: Unpinned External Package Executes with Access to Home Assistant Credentials## Vulnerability Details **File Location**: `SKILL.md:6`, `SKILL.md:14-16`, and `README.md:24-35` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code `SKILL.md:6`: ```yaml metadata: {"moltbot":{"emoji":"🏠","requires":{"bins":["moltbot-ha"],"env":["HA_TOKEN"]},"primaryEnv":"HA_TOKEN","install":[{"id":"uv","kind":"uv","package":"moltbot-ha","bins":["moltbot-ha"],"label":"Install moltbot-ha (uv tool)"}]}} ``` `SKILL.md:14-16`: ```bash uv tool install moltbot-ha ``` `README.md:24-35`: ```bash uv tool install moltbot-ha ``` ```bash pip install moltbot-ha ``` ```bash git clone https://github.com/iamvaleriofantozzi/moltbot-ha.git cd moltbot-ha uv tool install . ``` ### Technical Analysis The Skill instructs users and agents to install `moltbot-ha` from a mutable external package registry or repository without specifying an exact version, immutable commit, package hash, signature, or lockfile. The audited artifact contains only documentation and configuration; it does not contain the executable implementation. Therefore, the installed package's credential handling, safety checks, service-call validation, and logging behavior cannot be verified from this artifact. The metadata explicitly grants the installed executable access to `HA_TOKEN`. A package-registry compromise, maintainer-account compromise, malicious replacement release, or unexpected incompatible update could therefore execute arbitrary package code in the user's environment while inheriting a reusable Home Assistant credential. ### Attack Path 1. An attacker compromises the package registry entry, release process, maintainer credentials, or referenced repository. 2. The attacker publishes a modified `moltbot-ha` package under the same mutable package name. 3. A user or agent follows the documented `uv tool install moltbot-ha` or `pip install moltbot-ha` instruction. 4. The pa ...[truncated 1139 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to an exact reviewed version, such as `moltbot-ha==X.Y.Z`. 2. Require cryptographic hash verification for downloaded distributions and publish expected hashes through a separately protected channel. 3. Include a lockfile that resolves every transitive dependency to an exact version and integrity digest. 4. Reference source installations by an immutable commit hash rather than a mutable branch or tag. 5. Include the corresponding CLI source in the audited artifact, or provide verifiable provenance connecting the package artifact to reviewed source. 6. Sign releases and verify signatures before installation. 7. Use automated dependency monitoring and reproducible builds. 8. Run the CLI under a dedicated, restricted operating-system account or container. 9. Issue a dedicated, minimally privileged Home Assistant credential and rotate it if package integrity is ever uncertain. 10. Prevent the dependency from accessing unrelated environment variables, files, and network destinations through sandboxing or an explicit execution policy.

T09 · Insecure Skill Coding Practices

Error

• Location: config.example.toml:6
• Finding: Long-Lived Home Assistant Credentials May Be Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `config.example.toml:6-11`, `SKILL.md:23`, `SKILL.md:249-250`, `README.md:48`, `README.md:78`, `README.md:218`, and `README.md:257` **Vulnerability Type**: Plaintext transmission of reusable authentication credentials **Risk Level**: High ### Vulnerable Code `config.example.toml:6-11`: ```toml # Examples: # - Local: http://192.168.1.100:8123 # - mDNS: http://homeassistant.local:8123 # - Tailscale: http://homeassistant.ts.net:8123 # - Nabu Casa: https://xxxxx.ui.nabu.casa url = "http://homeassistant.local:8123" ``` `SKILL.md:249-250`: ```toml [server] url = "http://homeassistant.local:8123" ``` `README.md:78`: ```bash export HA_URL="http://192.168.1.100:8123" export HA_TOKEN="your_token_here" moltbot-ha config init --no-interactive moltbot-ha test ``` `README.md:257`: ```text - **IP address** (recommended): `http://192.168.1.100:8123` - **Tailscale**: `http://homeassistant.ts.net:8123` - **Avoid mDNS** in Docker: `homeassistant.local` often doesn't work - **Nabu Casa**: `https://xxxxx.ui.nabu.casa` (requires subscription) ``` ### Technical Analysis The example configuration defaults to an unencrypted `http://` endpoint, and the documentation explicitly recommends a plaintext IP-address URL. The CLI authenticates using a Home Assistant long-lived access token. When bearer-style credentials and API requests are sent over HTTP, the transport provides neither confidentiality nor cryptographic server authentication. An attacker capable of observing or modifying traffic on the relevant network path could potentially capture the reusable token, inspect entity information, replay authenticated requests, alter service calls, or impersonate the Home Assistant endpoint. Storing the token in an environment variable does not mitigate exposure while it is transmitted over an unencrypted connection. The risk applies especially to shared Wi-Fi, ...[truncated 1508 chars]
• Remediation: ## Remediation Suggestions 1. Change all defaults and recommended examples to `https://` endpoints. 2. Reject plaintext HTTP by default in the CLI, with any exception requiring an explicit, prominently warned local-development option. 3. Configure Home Assistant or a trusted reverse proxy with TLS using a certificate valid for the configured hostname. 4. Enforce certificate and hostname validation; do not recommend disabling TLS verification. 5. For private deployments, use a trusted internal certificate authority and install its root certificate securely on the CLI host. 6. If a VPN such as Tailscale is used, prefer HTTPS within the tunnel as defense in depth. 7. Use a dedicated Home Assistant account or credential with the minimum permissions required for intended entities and actions. 8. Revoke and rotate any long-lived token that may previously have traversed an untrusted plaintext connection. 9. Consider short-lived credentials or an authenticated local proxy where supported. 10. Add automated configuration validation that warns or fails when a non-loopback `http://` URL is supplied.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Credential Access

High

• Category: Privilege Escalation

Content

### 401 Unauthorized
- Verify `HA_TOKEN` is set correctly
- Ensure token is a **Long-Lived Access Token** (not temporary)
- Check token hasn't been revoked in Home Assistant

### Entity Not Found

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### 401 Unauthorized
- Verify `HA_TOKEN` is set correctly
- Ensure token is a **Long-Lived Access Token** (not temporary)
- Check token hasn't been revoked in Home Assistant

### Entity Not Found

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#   - Nabu Casa: https://xxxxx.ui.nabu.casa
url = "http://homeassistant.local:8123"

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#   - Nabu Casa: https://xxxxx.ui.nabu.casa
url = "http://homeassistant.local:8123"

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#   - Nabu Casa: https://xxxxx.ui.nabu.casa
url = "http://homeassistant.local:8123"

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

[safety]

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

[safety]

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

[safety]

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Level | Behavior |
|-------|----------|
| 0 | No safety checks (⚠️ dangerous!) |
| 1 | Log actions only, no confirmations |
| 2 | Confirm all write operations |
| 3 | Confirm critical operations only (🏅 **recommended**) |

• Confidence: 80% confidence
• Finding: The README explicitly documents a safety mode where confirmations can be disabled or reduced, including 'No safety checks' and a recommended mode that confirms only critical operations. In an agent-operated smart home context, this can enable autonomous state-changing actions without human approval, increasing the chance of unsafe or unauthorized physical-world actions such as unlocking, opening covers, or activating devices.

Session Persistence

Medium

• Category: Rogue Agent

Content

export HA_TOKEN="your_token_here"
```

To create a token:
1. Open Home Assistant → Profile (bottom left)
2. Scroll to "Long-Lived Access Tokens"
3. Click "Create Token"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Long-lived access token (required)
# Prefer setting via HA_TOKEN environment variable for security.
# To create: HA → Profile → Long-Lived Access Tokens → Create Token
# token = "eyJ..."

[safety]

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.