Grid-Aware Energy Load Shifter

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:37 PM UTC
• Version: 1.0.3

Overview

This Home Assistant energy skill is mostly coherent, but it can read and control more household devices than its energy-focused framing clearly limits.

Install only if you are comfortable giving the skill access to Home Assistant. Use a dedicated low-privilege Home Assistant user, prefer HTTPS, avoid broad admin tokens, review every call-service target, and do not let it operate scripts, automations, HVAC, water heaters, or chargers without explicit confirmation and an entity allowlist.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ha_bridge.py:49

Finding

Home Assistant bearer token may be transmitted over plaintext HTTP

Content

View full analysis

`. 4. An attacker with network observation or man-in-the-middle capabi ...[truncated 927 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/ha_bridge.py:253

Finding

Domain-only service filtering permits non-energy and security-sensitive device actions

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/ha_bridge.py:137

Finding

Read commands allow access to arbitrary Home Assistant entities and household history

Content

View full analysis

dict: """ Fetch the full state object for a single entity. Returns dict with: entity_id, state, attributes, last_changed, last_updated. """ result = ha_request("GET", f"/api/states/{entity_id}", config) return _format_state(result) ``` ```python def discover_energy_entities(config: dict) -> list: """ Scan all HA entities and return those relevant to energy management. """ all_states = ha_request("GET", "/api/states", config) ``` ```python def get_entity_history(entity_id: str, hours: float, config: dict) -> list: start = datetime.now(timezone.utc) - timedelta(hours=hours) ts = start.strftime("%Y-%m-%dT%H:%M:%S") endpoint = f"/api/history/period/{ts}?filter_entity_id={entity_id}&minimal_response&no_attributes" result = ha_request("GET", endpoint, config) ``` ```python p_status.add_argument( "entity_id", help="Entity ID to query (e.g. sensor.electricity_price)", ) ``` ```python p_hist.add_argument( "entity_id", help="Entity ID to query history for", ) ``` ```python if args.command == "status": result = get_entity_state(args.entity_id, config) _output(result) ``` ```python elif args.command == "history": results = get_entity_history(args.entity_id, args.hours, config) _output({"entity_id": args.entity_id, "hours": args.hours, "states": results}) ``` ### Technical Analysis Although the Skill declares an energy-management purpose, the `status` and `history` commands accept any caller-provided Home Assistant entity ID. There is no energy-domain, device-class, keyword, or configured-entity validation before the request is sent and its result is print ...[truncated 2100 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill is presented as an optimization and analysis tool, but the documented behavior includes direct Home Assistant service invocation that can change device state and trigger automations. This description-behavior mismatch is dangerous because users may grant trust and credentials expecting passive analytics, while the skill can actively control household equipment such as HVAC, chargers, and water heaters.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

Environment:
    HA_URL    Base URL of Home Assistant (e.g. http://homeassistant.local:8123)
    HA_TOKEN  Long-Lived Access Token for authentication

Exit codes:
    0  Success

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

Environment:
    HA_URL    Base URL of Home Assistant (e.g. http://homeassistant.local:8123)
    HA_TOKEN  Long-Lived Access Token for authentication

Exit codes:
    0  Success

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ha_bridge.py (reported line 21)May include surrounding context.

python

Environment:
    HA_URL    Base URL of Home Assistant (e.g. http://homeassistant.local:8123)
    HA_TOKEN  Long-Lived Access Token for authentication

Exit codes:
    0  Success

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly advertises the ability to control physical devices via Home Assistant services, but it does not warn users that these actions can directly affect household equipment and environmental systems. In the context of EV charging, HVAC, pool pumps, and water heaters, unsafe or unintended activation can cause equipment wear, energy cost spikes, comfort/safety issues, or interactions with critical home loads.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill exposes capabilities that use environment-sourced credentials and network access to Home Assistant, but it does not declare an explicit tool scope or permissions boundary in the skill manifest. That omission increases the chance of overbroad execution and weakens reviewability, especially because the documented commands include both read operations and device-controlling service calls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.