Nest Devices

This skill mostly does what it says (Nest control + webhook), but there are important red flags to check before installing: - Expect to provide sensitive credentials: Nest OAuth client_id/client_secret/refresh_token (or equivalent 1Password item and OP service account token). The registry metadata omitted these — do not assume none are needed. - Review and restrict any CLAWDBOT_GATEWAY_URL and CLAWDBOT_HOOKS_TOKEN usage. The webhook will POST events (including potentially images) to GATEWAY_URL/hook with the token. Only point this at a gateway you control and keep the token secret. - The webhook can send images to Telegram if TELEGRAM_BOT_TOKEN/CHAT_ID are set. If you don't want images leaving your network, omit Telegram and/or run the webhook on an isolated host. - The SKILL.md instructs creating systemd services and a cloudflared tunnel — these create persistent network exposure. Prefer running the webhook in a dedicated, network-isolated VM or container and verify the cloudflared binary and its credentials come from the official release. - The code invokes local binaries ('op', 'ffmpeg') via subprocess. Verify you trust those binaries and their locations; supply credentials via environment variables instead of broad 1Password service-account tokens where possible. - If you must install, audit the included scripts (nest.py and nest-webhook.py) yourself, and update the registry metadata to reflect required env vars so future users are not surprised. If you are not comfortable granting any of the listed tokens or creating persistent services and tunnels, do not install. If you proceed, limit tokens' scopes, run in isolation, and review outgoing endpoints (Telegram and any gateway) carefully.