ClawHub
Back to skill

Security audit

Home Assistant

Security checks for vulnerabilities and agentic risk

Overview

This Home Assistant skill appears purpose-built rather than malicious, but it gives broad smart-home control using long-lived credentials without enough safety or transport guardrails.

Install only if you are comfortable giving the agent broad Home Assistant control. Use HTTPS or WSS only, keep the token out of prompts and logs, restrict file permissions on the config file, prefer a dedicated least-privileged Home Assistant account where possible, and require manual confirmation before locks, covers, alarms, climate, scripts, automations, or generic service calls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ha.sh:20
Finding

Long-Lived Access Token Can Be Transmitted over Plaintext Connections

Content
View full analysis
Remediation
View remediation
&2 exit 1 ;; esac ``` 2. If plaintext HTTP must be supported for isolated development environments, require an explicit opt-in variable such as `HA_ALLOW_INSECURE_HTTP=1` and display a prominent warning. It should not be the documented default. 3. Replace the `http://` setup example in `SKILL.md` with an `https://` endpoint and explain that bearer credentials must not be sent over untrusted plaintext networks. 4. Replace `ws://` with `wss://` in `references/api.md` and state that WebSocket authentication tokens require TLS protection. 5. Preserve certificate verification. Do not add curl options such as `-k` or `--insecure`. For private Home Assistant deployments, document how to install or specify the appropriate trusted certificate authority instead. 6. Recommend creating a dedicated Home Assistant account with only the privileges required for the intended device operations. Avoid using a highly privileged administrator token where possible. 7. Protect the configuration file containing the token with restrictive permissions: ```bash chmod 600 ~/.config/home-assistant/config.json ``` 8. Revoke and replace any token that may previously have been transmitted over an untrusted plaintext connection. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared behavior claims inbound webhook support and a bounded purpose, but the file only documents outbound REST calls plus broader discovery and arbitrary service invocation. This mismatch can mislead reviewers and users about what the skill actually does and can cause underestimation of read/write access to the Home Assistant environment.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The skill instructs users to place a long-lived access token in an environment variable, which is a sensitive credential handling pattern. Environment variables are commonly exposed through shell history, process inspection, debug output, or inherited subprocess environments, making compromise of the Home Assistant instance more likely.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

export HA_TOKEN="your-long-lived-access-token"

text

### Getting a Long-Lived Access Token

1. Open Home Assistant → Profile (bottom left)
2. Scroll to "Long-Lived Access Tokens"

Credential Access

High
Category
Privilege Escalation
Confidence
73% confidence
Finding

The documentation encourages creation and use of a long-lived access token but does not discuss least privilege, rotation, revocation, or storage protections. For a skill that can read state and control arbitrary entities, compromise of such a token grants broad and durable access to the smart-home environment.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
### Getting a Long-Lived Access Token

1. Open Home Assistant → Profile (bottom left)
2. Scroll to "Long-Lived Access Tokens"
3. Click "Create Token", name it (e.g., "Clawdbot")
4. Copy the token immediately (shown only once)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ha.sh (reported line 163)May include surrounding context.

sh
Environment:
  HA_URL    Home Assistant URL (required)
  HA_TOKEN  Long-lived access token (required)

Examples:
  ha.sh on light.living_room 200

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly relies on shell execution via curl and jq but does not declare any tool scope or permission boundaries. That omission increases the chance an agent can invoke broad shell capabilities without explicit user or platform review, which is especially risky for a skill that can control physical devices and trigger automations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation presents smart-home control as routine API usage without warning that actions may unlock doors, open covers, change climate, activate devices, or trigger chained automations. In a home automation context, missing safety guidance materially increases the risk of harmful or privacy-impacting actions by users or agents.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Recommending storage of the Home Assistant URL and token in a persistent config file creates ongoing credential exposure if filesystem permissions are weak, backups are shared, or the host is multi-user. Persistent secrets are not inherently unsafe, but the documentation omits permission-hardening guidance for a file containing high-value credentials.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Option 1: Config File (Recommended)

Create ~/.config/home-assistant/config.json:

json
{
  "url": "https://your-ha-instance.duckdns.org",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Get Entity State

bash
curl -s -H "Authorization: Bearer $HA_TOKEN" "$HA_URL/api/states/light.living_room"

Control Devices

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The examples include broad automation, script, scene, and arbitrary service execution without highlighting that these actions may be irreversible, safety-sensitive, or privacy-impacting depending on entity configuration. In Home Assistant, a generic service call can indirectly control critical devices or execute complex automations with side effects far beyond the example shown.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation provides examples for controlling physical devices such as lights, climate systems, media players, blinds, garage covers, and notifications without any warning that these actions can have real-world safety, privacy, or property effects. In a home automation skill, this omission increases the chance that downstream agents or users will invoke actions like opening a garage or changing HVAC settings without appropriate confirmation or context-sensitive safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The webhook section shows how to trigger automations via /api/webhook/<webhook_id> but does not state that the webhook ID functions as a shared secret. If exposed, anyone with the ID may be able to trigger automations remotely, which is especially risky in a home-control context where automations may unlock, open, notify, or otherwise affect the physical environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The WebSocket example uses ws:// while instructing the client to send an access token during authentication, which implies transmitting bearer credentials over an unencrypted channel unless additional context is provided. In practice this can enable interception of the token and subsequent unauthorized control or observation of Home Assistant entities and events.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The generic call command allows invocation of any Home Assistant service using the full bearer token, which bypasses the narrower, safety-scoped command set otherwise exposed by the wrapper. In the context of an agent skill, this materially expands capability from predictable device control to arbitrary HA actions, including sensitive or dangerous services if available in the HA instance or installed integrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The authentication section tells users to use a long-lived access token but does not warn that this token is effectively a bearer secret that grants Home Assistant API access. Without guidance on secure handling, storage, rotation, and redaction, the documentation may encourage unsafe operational practices that lead to credential leakage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
74% confidence
Finding

The script loads HA_URL and HA_TOKEN from $HOME/.config/home-assistant/config.json when environment variables are absent. While practical, local credential-file access is not part of the stated smart-home control purpose and is an extra capability not mentioned in the manifest.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.