Security audit

Home Assistant

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly enables Home Assistant control through Selora MCP and discloses the major smart-home, privacy, and configuration-change risks with confirmation guidance.

Install only if you want an agent to manage your Home Assistant. Prefer OAuth or a custom least-privilege token, avoid admin access unless needed, review diffs and risk assessments before approving changes, and do not run the optional unpinned npx troubleshooting command unless you trust the current package source.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-management and YAML-editing tools allow creation, modification, and deletion of configuration and dashboard files, yet the reference lacks a prominent safety warning about configuration corruption, persistence of malicious logic, or service disruption. Because these files control Home Assistant behavior, misuse could implant unsafe automations, expose secrets, or render the home environment unstable until manual recovery.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest says to use the skill whenever the user asks about their smart home or Home Assistant, which is a very broad activation condition without clear boundaries or exclusions. This can cause unintended invocation for ordinary conversation about a user's home environment rather than an explicit request to use Home Assistant tools.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The documentation instructs users to run npx -y mcp-remote without pinning a specific version, so execution will fetch and run whatever package version is current at install time. In a high-privilege Home Assistant/OAuth troubleshooting context, that creates a software supply-chain risk: a compromised or maliciously updated package could execute arbitrary code on the user's system and potentially access tokens, local credentials, or Home Assistant-related secrets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The tool reference exposes highly sensitive read capabilities such as camera snapshots, diagnostics, logs, backups, and configuration access, but the documentation does not prominently warn that these may reveal private household information, credentials, or security-relevant metadata. In a smart-home skill, normalizing these reads without explicit privacy guidance increases the chance an agent or integrator will over-collect sensitive data from users' homes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The reference documents destructive and irreversible operations such as deleting automations, scenes, helpers, integrations, devices, dashboards, and other home configuration artifacts without consistently emphasizing permanence and user-confirmation requirements. In the Home Assistant context, these actions can break automations, disable security devices, or cause loss of home state/configuration with real-world safety consequences.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.