Lofy Home
v1.0.0Smart home control for the Lofy AI assistant — scene modes (study, chill, sleep, morning, grind), device management via Home Assistant REST API, presence-based automation, natural language commands for lights, music, thermostat, and PC wake-on-LAN. Use when controlling smart home devices, activating scene modes, or managing home automation.
⭐ 0· 882·0 current·0 all-time
byHarreynish Gowtham@harrey401
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description match the instructions: the SKILL.md describes Home Assistant scene and device control, WOL, and media commands, which align with the skill's home‑automation purpose.
Instruction Scope
The SKILL.md instructs the agent to read a local data file (data/home-config.json) and to make HTTP requests against a Home Assistant instance using environment variables ($HA_URL, $HA_TOKEN). Those runtime actions are within the declared purpose, but the instructions assume access to environment variables and a local config that are not declared in the registry metadata. There is nothing in SKILL.md that demands reading unrelated system files, but the missing declaration means the agent will need to prompt for or access secrets at runtime.
Install Mechanism
This is an instruction‑only skill with no install spec and no code files, so nothing will be written to disk by an installer—this is the lowest install risk.
Credentials
The skill clearly requires a Home Assistant URL and an authorization token (token name referenced as HA_TOKEN in the config example), but the registry lists no required environment variables or primary credential. Requesting an HA token is proportionate to the task, but the omission in metadata is a red flag because the skill will need a secret (Bearer token) to function; users must be aware which secret will be requested and should provide a least‑privilege token. The SKILL.md uses $HA_URL and $HA_TOKEN but does not document what scopes or privileges that token needs.
Persistence & Privilege
The skill does not request always:true and is user‑invocable only; it does not claim to modify other skills or system settings. No elevated persistence or cross‑skill modifications are indicated.
What to consider before installing
This skill appears to do what it says (control Home Assistant scenes, lights, media, and WOL), but the instructions expect an HA URL and a bearer token even though the skill metadata does not declare those required credentials. Before installing or using it: (1) verify the skill's origin — there is no homepage or source listed; (2) do not hand over an admin account token. Create a Home Assistant long‑lived access token with the minimum scopes needed (or a dedicated user with limited permissions) and provide only the HA_URL and that least‑privilege token when prompted; (3) confirm and review the data/home-config.json device entity_ids and MAC addresses so the skill cannot act on devices you didn't intend; (4) prefer using this only on a trusted local network or with network rules preventing unwanted external access; (5) if you cannot verify the publisher or you are uncomfortable supplying tokens, do not install—ask the publisher to update the registry metadata to declare required env vars (HA_URL/HA_TOKEN) and to provide a homepage/source for auditability.Like a lobster shell, security has layers — review code before you run it.
latestvk970gwrv88petjnhdc57r57gch80x2zk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.