Security checks across malware telemetry and agentic risk
This Tibber energy skill is mostly coherent, but its smart-home control mode can run arbitrary local shell commands when enabled.
Install only if you understand the command-execution feature and will keep control mode in dry-run until every command and threshold is verified. Avoid using --execute in unattended agent workflows or with command strings influenced by prompts, remote content, or untrusted config. Prefer read-only price and optimization commands unless you specifically need local automation.
def run_cmd(label: str, cmd: str, execute: bool):
print(f"{label}: {cmd}")
if execute:
subprocess.run(cmd, shell=True, check=True)
def command_control(args, token, home_id):64/64 vendors flagged this skill as clean.