Home Assistant

This skill appears to be a straightforward Home Assistant CLI, but there are some mismatches you should consider before installing: (1) The skill uses curl and jq and requires HA_URL and HA_TOKEN, yet the registry metadata doesn't declare those requirements — treat that as a red flag and confirm you understand what secrets the skill needs. (2) It recommends storing a long‑lived access token in ~/.config/home-assistant/config.json (plaintext in your home directory) — ensure the file permissions are locked (e.g., 600) and you are comfortable storing such a token there. (3) The SKILL.md explains receiving inbound webhooks to a "clawdbot" URL; if you plan to enable that, verify how the agent runtime exposes webhook endpoints, ensure the webhook URL is not publicly exposing sensitive controls, and require authentication/verification on inbound requests. (4) Because the skill's source/homepage is unknown, prefer installing only if you can audit the included script (scripts/ha.sh) yourself or if you trust the publisher. If you want to proceed, verify jq and curl are installed, create the config file with restrictive permissions, and consider using a short‑lived or limited token if possible. If you need higher assurance, ask the publisher for authoritative source and a homepage or inspect the script line‑by‑line (it is small and readable).