Homey - Home Automation

Control Homey home automation hub via CLI. Use when you need to control smart home devices (lights, thermostats, sockets, etc.), check device status, list zones, trigger flows, or perform any Homey automation tasks. Supports on/off, dimming, color changes, temperature control, and device inspection. Safe, capability-allowlisted operations only.

Security Scan

The skill's instructions require an OAuth client, npm install, and a run.sh wrapper (which would execute code), but the package contains only SKILL.md and declares no required env or install — this mismatch is suspicious and worth verifying before use.

Purpose & Capability

The stated purpose (control Homey via CLI) legitimately requires Homey OAuth credentials and a CLI implementation. However, registry metadata lists no required environment variables or binaries while SKILL.md explicitly requires HOMEY_CLIENT_ID, HOMEY_CLIENT_SECRET, HOMEY_REDIRECT_URL and a local CLI (run.sh). This metadata/instruction mismatch is incoherent.

Instruction Scope

SKILL.md directs the agent to run 'npm install' and 'bash run.sh' and to perform an OAuth login that stores tokens under ~/.config/homey-cli/. Those runtime actions involve executing code and storing credentials; the instruction set itself is focused on Homey tasks, but it presumes the presence of local code (run.sh and a package) that is not included—granting an agent permission to run arbitrary install/run steps without bundled code is risky.

Install Mechanism

There is no declared install spec in the registry, yet SKILL.md instructs running 'npm install' in 'skills/homey-cli' and using a run.sh script. Because no code files are present in the bundle, following these steps would pull packages from npm and try to execute a local script that doesn't exist in the skill archive. That combination (no install metadata + instructions to fetch and run code) is disproportionate and increases risk.

Credentials

The environment variables described in SKILL.md (HOMEY_CLIENT_ID, HOMEY_CLIENT_SECRET, HOMEY_REDIRECT_URL, and optional HOMEY_CLI_ALLOWED_CAPABILITIES) are appropriate for an OAuth-based Homey CLI. However, the skill metadata declares no required env vars or primary credential, which is inconsistent. The skill will also store tokens in the user's home (~/.config/homey-cli/), which is expected but should be disclosed in metadata.

Persistence & Privilege

The skill does not request always:true and does not ask to modify other skills or system-wide settings. It will store credentials and config in ~/.config/homey-cli/, which is a normal behavior for a CLI and reasonable for its purpose. Autonomous invocation is allowed by default (not a standalone red flag).

What to consider before installing

Do not install or run this skill without verifying its source and contents. Specific checks to perform before using it: - Confirm there is a publicly viewable code repository or official release (homepage/source is missing). If none exists, treat the package as untrusted. - Inspect run.sh and package.json (or equivalent) before running npm install; those files are not included in the skill bundle but SKILL.md expects them. Running npm install could pull arbitrary code. - Only create a Homey OAuth client and provide client secret if you trust the code that will use it. Prefer creating a client with the minimum scopes and revoke it if you suspect misuse. - Because tokens are stored under ~/.config/homey-cli/, plan where those credentials will live and consider using a throwaway account or isolated environment (VM/container) while testing. - Ask the publisher for the missing install files or a link to the code repository; if they cannot supply them or the run.sh/package contents look suspicious, do not proceed. If you want to proceed safely: obtain the exact CLI code, review it (or have someone audit it), run installs in a sandbox, and only then configure real credentials.

Homey CLI

Safe, agent-friendly CLI for controlling Homey home automation hubs.

What This Skill Provides

• Device control: Turn devices on/off, dim lights, change colors, set temperatures
• Device inspection: List devices, check status, read capabilities
• Zone management: List zones and devices per zone
• Flow control: List and trigger flows
• Inventory: Get complete hub overview

Setup

1. Install Dependencies

cd skills/homey-cli
npm install

2. Create Homey App Credentials

1. Go to https://tools.developer.homey.app/tools/app
2. Create a new app with:
   • Callback URL: http://localhost:8787/callback
   • Note your Client ID and Client Secret

3. Configure Environment

Create .env file:

export HOMEY_CLIENT_ID="your-client-id"
export HOMEY_CLIENT_SECRET="your-client-secret"
export HOMEY_REDIRECT_URL="http://localhost:8787/callback"

4. Login

bash run.sh auth login

Follow the OAuth flow in your browser. Tokens are stored in ~/.config/homey-cli/.

Usage

List Homeys

bash run.sh homey list

Select Active Homey

bash run.sh homey use <homeyId>

Device Operations

# List all devices
bash run.sh devices list

# List devices as JSON
bash run.sh devices list --json

# Get specific device
bash run.sh devices get <deviceId>

# Read capability value
bash run.sh devices read <deviceId> onoff

# Control devices
bash run.sh devices on <deviceId>
bash run.sh devices off <deviceId>
bash run.sh devices dim <deviceId> 0.4
bash run.sh devices color <deviceId> #FF8800
bash run.sh devices temperature <deviceId> 21.5

Flow Operations

# List flows
bash run.sh flows list

# Trigger flow
bash run.sh flows trigger <flowId>

Complete Inventory

bash run.sh inventory --json

Safety Model

Write operations are capability-allowlisted for safety:

• Default allowed: onoff, dim, light_hue, light_saturation, light_temperature, target_temperature
• Override via: export HOMEY_CLI_ALLOWED_CAPABILITIES=onoff,dim,target_temperature

Destructive operations (delete devices, modify flows, change app settings) are not supported.

Common Queries

When users ask:

• "Turn on the kitchen lights" → List devices, find match, use devices on <deviceId>
• "Dim living room to 50%" → Find device, use devices dim <deviceId> 0.5
• "What's the temperature in the bedroom?" → Find device, use devices read <deviceId> measure_temperature
• "List all my lights" → Use devices list --json and filter by class/capabilities

Configuration Storage

• Tokens: ~/.config/homey-cli/credentials.json
• Active Homey: ~/.config/homey-cli/config.json

Troubleshooting

• Auth errors: Re-run bash run.sh auth login
• Device not found: Check device name/ID with bash run.sh devices list
• Capability not allowed: Add to HOMEY_CLI_ALLOWED_CAPABILITIES or check if it's a read-only capability