ClawHub

Homey - Home Automation

Security checks across malware telemetry and agentic risk

Overview

This skill is for a real smart-home control system and is mostly transparent, but it asks users to run missing, unreviewed CLI files and stores powerful Homey credentials locally.

Install only if you trust the missing CLI implementation outside this reviewed artifact. Before use, inspect the referenced run.sh and package files, protect the .env and ~/.config/homey-cli files, avoid committing secrets, and require clear user confirmation before any device change or flow trigger.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation instructs users to create a .env containing a client secret and later notes that OAuth tokens are stored on disk, but it provides no explicit warning about protecting these secrets, excluding them from source control, or limiting file permissions. In an agent or shared workstation context, this increases the chance of credential leakage and subsequent unauthorized control of the Homey hub.

Credential Access

High
Category
Privilege Escalation
Content
## Configuration Storage

- **Tokens**: `~/.config/homey-cli/credentials.json`
- **Active Homey**: `~/.config/homey-cli/config.json`

## Troubleshooting
Confidence
89% confidence
Finding
credentials.json

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal