Skylight

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernMedium Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Running the provided login command could send marketing/text opt-in values the user did not explicitly approve.

Why it was flagged

These consent- or marketing-related fields are included in the login request used to generate an auth token, but the skill does not explain why they are necessary for calendar access.

Skill content

"textMeTheApp": "true", "agreedToMarketing": "true"

Recommendation

Remove these fields, set them to false, or document and request explicit user consent before sending them.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone with these environment variables or token could access or modify the user's Skylight household data.

Why it was flagged

The skill needs either the user's Skylight password or a full session authorization header to call the Skylight API.

Skill content

`SKYLIGHT_EMAIL`: Your Skylight account email
- `SKYLIGHT_PASSWORD`: Your Skylight account password

Option B - Pre-captured token:
- `SKYLIGHT_TOKEN`: Full Authorization header value

Recommendation

Store credentials carefully, avoid sharing logs or shell history containing tokens, and rotate or recapture the token if exposed.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

A trusted proxy certificate and captured session token are sensitive; if mishandled, they can expose account traffic or account access.

Why it was flagged

The optional token-capture method asks the user to intercept HTTPS traffic and extract an Authorization header.

Skill content

Install Proxyman/Charles/mitmproxy and trust root certificate ... Enable SSL proxying for `app.ourskylight.com` ... Copy `Authorization` header value

Recommendation

Prefer the normal login method when possible, limit proxying to the Skylight domain, remove the proxy root certificate afterward, and protect captured tokens.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If used incorrectly, the agent could create or change chores, task box items, or other household data.

Why it was flagged

The skill documents raw API calls that can create or manage Skylight household items.

Skill content

curl -s -X POST "$SKYLIGHT_URL/api/frames/$SKYLIGHT_FRAME_ID/chores"

Recommendation

Use the skill only for requested Skylight changes and confirm details before running write operations.