Wled

• Analyzed: May 12, 2026, 3:13 AM
• Findings: 1
• Version: 0.1.0
• Hash: 2264a388755c2796872ec146d53e86e886dea9b783e05e216e92b7e94fb969e0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's code and documentation are clearly aligned with its stated purpose of controlling WLED devices via their HTTP API. The `scripts/wled.py` script makes HTTP requests to user-specified WLED device IPs/hostnames and reads configuration from designated `~/.wled/config.json` or `WLED_HOST` environment variable. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md` to subvert the agent's purpose or access unrelated sensitive data. All network and file access is limited to the scope of WLED control and configuration.