ClawHub
Back to skill

Security audit

Home Assistant

Security checks across malware telemetry and agentic risk

Overview

The skill is a Home Assistant connector that can run real control actions, but its description and safety labels make those write capabilities too easy to miss.

Install only if you trust OOMOL and want the assistant to operate your connected Home Assistant account. Treat `call_service`, `fire_event`, and dynamically supplied templates as sensitive; require explicit confirmation of the exact action, target entities, and expected effect before running them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest description says the skill is for 'searching and reading data,' but the documented actions include `call_service` and `fire_event`, which can change Home Assistant state. This mismatch can mislead an agent or user into invoking the skill under a read-only assumption, increasing the chance of unintended writes in a home automation environment.

Intent-Code Divergence

Low
Confidence
79% confidence
Finding
The safety section treats untagged actions as read-only, yet `render_template` is untagged even though Home Assistant templates may expose sensitive data and, depending on platform behavior or extensions, may have side effects or trigger expensive evaluation. Misclassifying it as inherently safe lowers operator caution and could lead to unsafe execution assumptions.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger text says to use this skill for 'ANY Home Assistant request,' which is overly broad and may cause the agent to route all Home Assistant-related tasks through this skill without checking whether the operation is read-only, write-capable, or even appropriate. In context, that broad routing is more dangerous because the skill includes state-changing actions against a real home automation system.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.