Security audit

Homebridge

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward Homebridge controller, but users should understand it can affect real smart-home devices.

Install only if you intend to let the agent control your Homebridge accessories. Store the Homebridge credential file carefully, verify the configured Homebridge URL is your own instance, and use extra confirmation for actions that could affect safety, comfort, or energy use, such as thermostats or powered devices.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly performs outbound network operations against a Homebridge REST API, yet no declared permissions are present. Missing permission declarations weaken review and user awareness, and can allow a network-capable skill to be installed or invoked without explicit disclosure of its external communication behavior.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This skill can directly change the state of real smart-home devices, including lights, fans, and thermostats, but the description and usage guidance do not prominently warn users about those real-world effects. That omission increases the risk of accidental or unsafe actions, especially for sensitive devices where turning equipment on/off or changing temperature has physical consequences.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.