Security audit
Security checks across malware telemetry and agentic risk
This smart-home skill appears useful, but it reaches into real device control, credentials, local installs, and background automation with weaker scoping and warnings than that authority deserves.
Install only if you are comfortable giving the skill practical authority over your smart-home systems. Use test devices first, avoid storing long-lived tokens in plaintext, change default Homebridge credentials, prefer HTTPS/local-only access, review any automation before enabling it, and do not run remote install scripts with sudo unless you have independently verified them.
def _login(self) -> bool:
"""Authenticate with Homebridge and get JWT token."""
try:
resp = requests.post(f"{self.base_url}/api/auth/login", json={
"username": self.username,
"password": self.password,
}, timeout=10)### Step 2: If User Grants Access — Guide API Setup **Home Assistant:** - Guide to Settings → Long-Lived Access Tokens - Save URL and token to profile - Test connection with a simple API call
if ! command -v node &> /dev/null; then
echo "Error: Node.js not found. Please install Node.js 18+ first."
echo " macOS: brew install node"
echo " Linux: curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - && sudo apt install -y nodejs"
exit 1
fiif ! command -v node &> /dev/null; then
echo "Error: Node.js not found. Please install Node.js 18+ first."
echo " macOS: brew install node"
echo " Linux: curl -fsSL https://deb.nodesource.com/setup_18.x | sudo -E bash - && sudo apt install -y nodejs"
exit 1
fi64/64 vendors flagged this skill as clean.
No suspicious patterns detected.