ClawHub
Back to skill

Security audit

Home Assistant Agent (Secure)

Security checks for vulnerabilities and agentic risk

Overview

This Home Assistant skill is purpose-aligned, but it needs Review because its default setup uses a long-lived smart-home token with insecure TLS and limited technical safeguards.

Install only if you are comfortable giving OpenClaw a long-lived Home Assistant token. Use a dedicated non-admin Home Assistant user with the smallest possible device/entity access, remove curl -k unless you have explicitly configured trusted certificates another way, avoid storing the token in shell profiles, lock down any token file permissions, and revoke/rotate the token if exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:89
Finding

TLS Certificate Verification Disabled for Authenticated Home Assistant Requests

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:51
Finding

Long-Lived Home Assistant Token Stored in Plaintext Without File-Permission Hardening

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md
- `curl` on PATH
- A running Home Assistant instance with HTTPS access
- A **restricted (non-admin)** HA user with a Long-Lived Access Token

> **Note:** If your HA instance uses a self-signed certificate, the skill uses curl's `-k` flag to allow the connection. If you use a trusted certificate (e.g. Let's Encrypt), you can remove the `-k` flag from the curl command in `SKILL.md`.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
- `curl` on PATH
- A running Home Assistant instance with HTTPS access
- A **restricted (non-admin)** HA user with a Long-Lived Access Token

> **Note:** If your HA instance uses a self-signed certificate, the skill uses curl's `-k` flag to allow the connection. If you use a trusted certificate (e.g. Let's Encrypt), you can remove the `-k` flag from the curl command in `SKILL.md`.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

md
### 1. Set Up Home Assistant

1. Create a non-admin user in HA (e.g. `openclaw-bot`) via **Settings > People > Add Person**
2. Log in as that user and go to **Profile > Long-Lived Access Tokens > Create Token**
3. Copy the token immediately

### 2. Install the Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
### 1. Set Up Home Assistant

1. Create a non-admin user in HA (e.g. `openclaw-bot`) via **Settings > People > Add Person**
2. Log in as that user and go to **Profile > Long-Lived Access Tokens > Create Token**
3. Copy the token immediately

### 2. Install the Skill

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

This section accurately notes a real security caveat: the Home Assistant long-lived token is not scoped to only the conversation endpoint, so compromise of the token would allow access to any API endpoints permitted to that user. In this skill's context, the danger is reduced by using a restricted non-admin account, but the control is procedural rather than technically enforced by the credential itself.

Content

Scanner excerpt · README.md (reported line 124)May include surrounding context.

md
- The token should belong to a **non-admin** user with limited area/entity access
- The token is **never** echoed or logged by the skill
- If Assist can't handle a request, the skill reports the error rather than falling back to other API calls
- **Important caveat:** The Long-Lived Access Token is not technically scoped to the Conversation API — it grants access to all HA API endpoints available to that user. The endpoint restriction is enforced by the skill instructions, not by the token itself. This is why using a **restricted non-admin user** is critical — it limits the blast radius even if the token is misused

### Trusted Networks Warning

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

The skill forwards arbitrary 'USER REQUEST HERE' text directly to Home Assistant's Assist API, meaning untrusted user input becomes a privileged device-control action with no local validation or allowlisting. Although the skill limits calls to a single endpoint and recommends a restricted HA user, a malicious or unsafe prompt could still trigger unintended actions on all entities that account can control.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Send any smart home command in natural language. The skill passes it directly to HA Assist:

bash
curl -sk -X POST "$HOME_ASSISTANT_URL/api/conversation/process" \
  -H "Authorization: Bearer $HOME_ASSISTANT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"text": "USER REQUEST HERE", "language": "DETECTED LANGUAGE CODE"}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

md
### 1. Set Up Home Assistant

1. Create a non-admin user in HA (e.g. `openclaw-bot`) via **Settings > People > Add Person**
2. Log in as that user and go to **Profile > Long-Lived Access Tokens > Create Token**
3. Copy the token immediately

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
## Setup

### 1. Create a Restricted Home Assistant User

1. In Home Assistant go to **Settings → People → Add Person**
2. Create a new user (e.g. `openclaw-bot`)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Send any smart home command in natural language. The skill passes it directly to HA Assist:

bash
curl -sk -X POST "$HOME_ASSISTANT_URL/api/conversation/process" \
  -H "Authorization: Bearer $HOME_ASSISTANT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"text": "USER REQUEST HERE", "language": "DETECTED LANGUAGE CODE"}'

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md
Many languages use grammatical cases or word inflection, causing entity names to change form in natural speech. Home Assistant entity names are typically in their base/dictionary form (nominative), but users naturally use other grammatical forms in commands.

This affects languages including (but not limited to):
- **Polish** — 7 cases (e.g. *drukarkę* → *drukarka*, *lampę* → *lampa*)
- **Czech** — 7 cases (e.g. *tiskárnu* → *tiskárna*, *lampu* → *lampa*)
- **German** — 4 cases + articles (e.g. *den Drucker* → *Drucker*, *die Lampe* → *Lampe*)

Static analysis

No suspicious patterns detected.