Home Assistant Control

This skill appears to implement Home Assistant control and the scripts will talk only to your Home Assistant instance — which is expected — but there are several packaging inconsistencies you should resolve before installing or running it: - The scripts expect a credentials file at ~/.openclaw/credentials/homeassistant.json containing {"url":"...","token":"LONG_LIVED_ACCESS_TOKEN"}. That path is not declared in the registry metadata; verify you are comfortable storing a long-lived HA token there and ensure file permissions are restrictive (chmod 600). - SKILL.md and README mention a scripts/service.sh for generic service calls, but service.sh is not included in the manifest. Ask the author for the missing script or remove references; running with missing pieces may lead to confusing failures. - climate.sh uses bc for floating-point comparisons but 'bc' is not listed in required binaries. Ensure bc is installed or the script may fail. - The documentation contains a hard-coded private IP (http://192.168.2.82:8123) likely leftover from the author's environment—update to your HA URL before running anything. - The scripts only send requests to the configured HA URL and do not call external endpoints, but because they read a local file containing a long-lived token, treat that token as sensitive. Consider creating a token with the minimum necessary privileges or using a dedicated integration with more limited scope if possible. If the token is ever exposed, revoke it from your Home Assistant profile immediately. If the author can (1) add the credentials path to the skill metadata, (2) include or remove references to the missing service.sh, and (3) list bc in required binaries, the package would be much clearer and the remaining risks are typical for an integration that requires a local access token.