minos

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:51 AM UTC
• Version: 1.0.0

Overview

This Home Assistant skill matches its stated smart-home purpose, but its setup script can execute shell code from its configuration inputs and it stores a long-lived token in a shell-sourced file.

Review before installing. Use only a least-privileged Home Assistant token, prefer HTTPS, avoid adding the token file to shell startup, and do not run ha-setup.sh with untrusted HA_URL or token values. Be aware that commands can change lights, switches, climate devices, scenes, and other connected equipment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ha-setup.sh:29

Finding

Arbitrary Command Execution Through Unsafe Shell Configuration Generation

Content

View full analysis

Long-Lived Access Tokens > Create Token)" read -s -p "HA_TOKEN: " HA_TOKEN echo if [ -z "$HA_TOKEN" ]; then echo "Error: HA_TOKEN cannot be empty" exit 1 fi # Save configuration cat > ~/.homeassistant.conf << EOF # Home Assistant Configuration # Generated on $(date) export HA_URL="$HA_URL" export HA_TOKEN="$HA_TOKEN" EOF chmod 600 ~/.homeassistant.conf echo echo "=== Configuration saved to ~/.homeassistant.conf ===" echo echo "To use these settings, run:" echo " source ~/.homeassistant.conf" echo echo "Or add to your ~/.bashrc:" echo " source ~/.homeassistant.conf" echo echo "Testing API connection..." source ~/.homeassistant.conf ``` The script also sources an existing configuration without validating it: ```bash if [ -f ~/.homeassistant.conf ]; then echo "Found existing config: ~/.homeassistant.conf" source ~/.homeassistant.conf ``` ### Technical Analysis `HA_URL` and `HA_TOKEN` are read dir ...[truncated 2499 chars]

Remediation

View remediation

"$CONFIG_FILE" ``` Parsing data rather than sourcing code remains preferable. 3. Do not automatically source the newly generated file. Test the API with the in-memory variables already collected by the script. 4. Before reading an existing configuration, reject symbolic links and verify that the file is a regular file owned by the expected user with restrictive permissions. 5. Validate `HA_URL` using a strict URL parser or allowlist. Reject newlines, carriage returns, shell metacharacters, embedded credentials, and unsupported schemes. 6. Create the configuration atomically with restrictive permissions from the outset, for example by setting `umask 077` and writing to a securely created temporary file before renaming it. 7. Add regression tests using quotes, command substitutions, semicolons, newlines, and backticks to confirm that configuration input can never be interpreted as shell code. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ha-bridge.py:74

Finding

Long-Lived Home Assistant Token Can Be Transmitted Over Plaintext HTTP

Content

View full analysis

Any: """Make API request""" url = f"{self.url}/api/{endpoint}" try: response = requests.request( method, url, headers=self.headers, json=data, timeout=30 ) ``` The setup script explicitly presents plaintext HTTP as a supported configuration: ```bash echo "Enter your Home Assistant URL:" echo " Examples: http://homeassistant.local:8123" echo " http://192.168.1.100:8123" echo " https://ha.yourdomain.com" read -p "HA_URL: " HA_URL ``` It then transmits the token to the configured URL: ```bash RESPONSE=$(curl -s -H "Authorization: Bearer $HA_TOKEN" \ -H "Content-Type: application/json" \ "$HA_URL/api/" 2>/dev/null || echo "") ``` The Python client constructs the reusable bearer credential as follows: ```python self.headers = { 'Authorization': f'Bearer {self.token}', 'Content-Type': 'application/json' } ``` ### Technical Analysis A Home Assistant long-lived access token is a reusable bearer credential. Possession of the token is sufficient to authenticate with the API using the privileges of the account that issued it. Both the setup script and Python bridge accept an `http://` base URL and send the bearer token without transport encryption. Plain HTTP supplies neither confidentiality nor authenticated server identity. An attacker able to observe or manipulate the network path can read the `Authorization` header, redirect traffic to a malicious endpoint, or impersonate the configured Home Assistant server. This i ...[truncated 1603 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

## Requirements

- Home Assistant instance (local or remote)
- Long-lived access token ([HA Profile → Security → Long-Lived Access Tokens](https://www.home-assistant.io/docs/authentication/#your-account-profile))
- Python 3 with `requests` module
- Network access to your HA instance

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ha-setup.sh (reported line 52)May include surrounding context.

sh

## Requirements

- Home Assistant instance (local or remote)
- Long-lived access token ([HA Profile → Security → Long-Lived Access Tokens](https://www.home-assistant.io/docs/authentication/#your-account-profile))
- Python 3 with `requests` module
- Network access to your HA instance

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill presents itself as a Home Assistant control tool but also performs credential collection and persistent local storage of authentication material in the user's home directory. Storing and partially revealing tokens materially changes the risk profile because compromise of local files or logs could expose long-lived credentials with broad access to the smart-home environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill presents itself as a Home Assistant control tool but also performs credential collection and persistent local storage of authentication material in the user's home directory. Storing and partially revealing tokens materially changes the risk profile because compromise of local files or logs could expose long-lived credentials with broad access to the smart-home environment.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md

## Prerequisites

- Home Assistant instance running (local or remote)
- Long-lived access token from HA profile
- Network connectivity to HA instance
- Python 3 with `requests` module

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

## Prerequisites

- Home Assistant instance running (local or remote)
- Long-lived access token from HA profile
- Network connectivity to HA instance
- Python 3 with `requests` module

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ha-setup.sh (reported line 49)May include surrounding context.

sh

fi
fi

# Get Long-Lived Access Token
echo
echo "Enter your Home Assistant Long-Lived Access Token:"
echo "  (Get it from HA Profile > Long-Lived Access Tokens > Create Token)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ha-setup.sh (reported line 51)May include surrounding context.

sh

fi
fi

# Get Long-Lived Access Token
echo
echo "Enter your Home Assistant Long-Lived Access Token:"
echo "  (Get it from HA Profile > Long-Lived Access Tokens > Create Token)"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation describes shell, environment, and network-capable behavior but does not declare any tool scope or permission boundaries. In an agent setting, this increases the chance the skill can be invoked with broader capabilities than users expect, enabling unintended network access, local file interaction, and command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation lacks a clear warning that commands can change physical device state in a real home environment. In this context, omissions are more dangerous because the skill can affect lights, climate systems, scenes, and possibly other connected devices, creating safety, privacy, or nuisance risks if triggered unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup instructions direct users to store a long-lived Home Assistant token in a local configuration file and source it into the shell without warning about credential sensitivity. This raises the likelihood of accidental disclosure through weak file permissions, shell history, logs, backups, or other local processes, potentially granting broad control over the home automation system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes example commands to turn a switch on and off, which can affect physical devices or home automations. The description does not include any warning or disclosure that these commands act on real entities and may change device state.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/finding-entities.md (reported line 58)May include surrounding context.

md

1. **Friendly Names** können sich ändern, Entity IDs bleiben stabil
2. **Immer Entity ID verwenden** für Automationen und Skripte
3. **Dokumentieren** welche Entity IDs zu welchen Geräten gehören
4. **jq installieren** für bessere Filterung: `sudo apt install jq`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code makes HTTP requests to a Home Assistant API and is used by commands such as state, states, search, services, and history to retrieve potentially sensitive home-device and occupancy-related data. While the module docstring says it provides programmatic access, there is no explicit warning in the CLI help, comments near the request path, or confirmation/disclosure that these commands send and retrieve user/system data over the network.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

In context, this finding maps to the script collecting a long-lived token and then persisting it for ongoing reuse, effectively creating durable session-like access to the Home Assistant API. A stolen long-lived token can allow continued unauthorized control of smart home devices, sensor access, and automation management until the token is revoked.

Content

Scanner excerpt · scripts/ha-setup.sh (reported line 52)May include surrounding context.

sh

# Get Long-Lived Access Token
echo
echo "Enter your Home Assistant Long-Lived Access Token:"
echo "  (Get it from HA Profile > Long-Lived Access Tokens > Create Token)"
read -s -p "HA_TOKEN: " HA_TOKEN
echo

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes the Home Assistant long-lived access token into ~/.homeassistant.conf as plaintext and then instructs the user to source it from their shell startup. Even with chmod 600, plaintext credential storage increases the risk of accidental disclosure through backups, terminal support sessions, dotfile syncing, or local compromise, and the script does not clearly warn users about that tradeoff.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/ha-setup.sh (reported line 69)May include surrounding context.

sh

export HA_TOKEN="$HA_TOKEN"
EOF

chmod 600 ~/.homeassistant.conf

echo
echo "=== Configuration saved to ~/.homeassistant.conf ==="

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Most instructional text in the file is German, which effectively forces a specific language for users reading the skill reference. The file does not offer an alternative language or explain that the content is intentionally limited to German-speaking users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.