Homey

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 1.1.2
• Hash: a5545160a68114ebcfc66fbe1a3b806b0f97dca95bcd7f83eb71b5e85a3d1f13
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle for Homey CLI is benign. It provides legitimate functionality for controlling smart home devices via local or cloud APIs. The skill handles authentication tokens securely by storing them with restricted permissions in `~/.homey/config.json` and using secure input methods (`--stdin`, `--prompt`) in `bin/homeycli.js` and `lib/commands.js`. Network and file system access are strictly aligned with its stated purpose (communicating with Homey devices, mDNS discovery, and managing its own configuration). There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's behavior beyond the skill's intended scope.