Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
aioesphomeapi>=18.0.0
- Confidence
- 94% confidence
- Finding
- aioesphomeapi>=18.0.0
Security audit
Emporia Energy
Security checks across malware telemetry and agentic risk
Overview
This skill transparently queries Emporia energy readings using expected cloud or local device credentials, with no evidence of hidden persistence, destructive behavior, or unrelated data sharing.
Install this only if you are comfortable giving it access to your Emporia account or local ESPHome device for energy readings. Keep credentials in environment or local config rather than chat, review output before sharing because device and circuit names may reveal household usage details, and consider pinning the ESPHome dependency for stricter repeatability.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.