Home Assistant

This skill appears to do what it says (connect Home Assistant to MCP clients) and legitimately needs a long‑lived Home Assistant token, but exercise caution before installing or following instructions. Key points to consider: - Verify origin and code: the registry entry has no homepage or source; ask the publisher for the integration/source code (especially for the Selora AI integration) and review it before installing on a home system. - Metadata mismatch: SKILL.md requires a HA_TOKEN but the registry metadata lists no required credentials — ask the publisher to correct this and confirm how credentials are handled. - Limit token scope: create a dedicated HA user with minimal permissions for MCP access if possible. Treat long‑lived tokens as highly sensitive and rotate/delete them if exposure is suspected. - Avoid embedding tokens in plaintext configs: the Claude Desktop example encourages pasting the token into a JSON config; prefer client support for environment variables, OS keychain, or a secrets manager. If a client forces plaintext tokens, consider that an operational risk. - Prefer secure tunnels and HTTPS (do not expose HA over plain HTTP to the internet). Follow the doc's own caution about --allow-http. - Audit third‑party components: examples use npx mcp-remote and point to SeloraBox/Selora AI and mcporter; review those packages/repos before executing network installs or running the bridge on your machine. If you cannot verify the source, repository, or the Selora integration's code and trustworthiness, do not proceed with exposing a full‑access HA token to external clients.