Back to skill
Skillv1.0.0
ClawScan security
Openhue Hardened · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 29, 2026, 1:43 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions align with its stated purpose (controlling Philips Hue via the OpenHue CLI); nothing requested is disproportionate, but the CLI will have local-network control so install from a trusted source and heed the included guardrails.
- Guidance
- This skill appears coherent and limited to controlling Philips Hue via the OpenHue CLI. Before installing: 1) Verify the Homebrew formula's source (confirm openhue/cli is official or trusted) since the installed binary will have local-network access. 2) Keep the provided guardrails (do not run discover/setup without explicit consent; never disclose bridge IPs/keys; do not pipe output to network destinations). 3) If you do not want the agent to be able to autonomously run device-control commands, consider disabling autonomous model invocation for this skill or only invoking it manually. 4) If you want extra assurance, inspect the installed `openhue` binary/package source before running it.
Review Dimensions
- Purpose & Capability
- okName/description match the declared runtime requirements: the skill needs the `openhue` binary and provides CLI commands to read/write lights and scenes. No unrelated credentials, files, or services are requested.
- Instruction Scope
- okSKILL.md only instructs the agent to run `openhue` commands (discover/setup/get/set). It also includes explicit guardrails that prevent automatic network scanning, data leakage, or disclosure of bridge IPs/keys. The instructions do not ask the agent to read unrelated files or environment variables.
- Install Mechanism
- noteInstall uses a Homebrew formula (openhue/cli/openhue-cli) which is an expected distribution mechanism for a CLI. Mild caution: this is a third‑party tap; verify the formula's provenance (official OpenHue tap or Homebrew core) before installing. No arbitrary URL downloads or archive extraction are present.
- Credentials
- okNo environment variables, credentials, or config paths are requested. The permission surface is limited to the presence and use of the `openhue` binary, which is appropriate for the stated functionality.
- Persistence & Privilege
- notealways:false and no special config writes — good. The skill is allowed to be invoked autonomously by the model (disable-model-invocation:false), which is the platform default; because the skill controls local devices, users should be aware that autonomous invocation could trigger local actions if the agent is permitted to call the skill.