Emporia Energy

• Analyzed: May 12, 2026, 3:09 AM
• Findings: 1
• Version: 1.0.0
• Hash: 79c9231bd6124cc8cf631b0ee826f63b79d4dec85fa2dafca8a67e0198ba4593
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to query Emporia energy data via cloud or local ESPHome APIs. All actions, including reading credentials from environment variables (`EMPORIA_EMAIL`, `EMPORIA_PASSWORD`, `ESPHOME_API_KEY`) and making network calls to specified endpoints, are directly aligned with its stated purpose. The `SKILL.md` includes a 'Safety' section instructing the agent not to print secrets, which is a positive indicator. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts against the agent to perform actions beyond the skill's stated scope. The use of base64 for `ESPHOME_API_KEY` is for a legitimate API key format, not obfuscation.