T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/ha-cmd.js:159- Finding
Physical-security restrictions can be bypassed through allowed scenes and automations
- Content
View full analysis
- Remediation
View remediation
Security audit
Home Assistant Hub
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed Home Assistant monitor and controller, but its defaults and safety controls can expose credentials and permit broader physical device control than users may expect.
Review this carefully before installing. Use HTTPS/WSS for Home Assistant, create a dedicated least-privileged Home Assistant account or token, remove scene and automation from call_safe_domains unless you have audited every downstream action, add a real .gitignore, restrict permissions on config and notification files, and avoid start.sh until its broad pkill behavior is fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ha-cmd.js:40- Finding
Long-lived Home Assistant bearer token is transmitted over plaintext by default
- Content
View full analysis
{ const url = new URL(path, haUrl || 'http://localhost:8123'); const isHttps = url.protocol === 'https:'; const lib = isHttps ? require('https') : require('http'); const options = { hostname: url.hostname, port: url.port || (isHttps ? 443 : 80), path: url.pathname + url.search, method, headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json', 'User-Agent': 'openclaw-ha-cmd/1.0' } }; ``` ```javascript const defaults = { ha_url: 'http://homeassistant.local:8123', ha_token: '', ``` ```javascript async function connectHA(config) { const haUrl = config.ha_url.replace('http', 'ws'); const wsPath = `${haUrl}/api/websocket`; log('info', `Connecting to HA at ${wsPath}`); return new Promise((resolve, reject) => { try { const ws = new WebSocket(wsPath); ws.onmessage = async (event) => { try { const msg = JSON.parse(event.data); if (msg.type === 'auth_required') { ws.send(JSON.stringify({ id: 1, type: 'auth', access_token: config.ha_token })); return; } ``` ```javascript async function haFetch(endpoint, token, baseUrl, method = 'GET', body = null) { const url = `${baseUrl}${endpoint}`; const fullUrl = endpoint.startsWith('/') ? url : `${url}/${endpoint}`; const headers = { 'Authorization': `Bearer ${token}`, ...[truncated 1822 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ha-hub.js:48- Finding
Credentials and household telemetry are written without restrictive file permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
start.sh:1- Finding
Startup script can terminate unrelated processes through broad command-line matching
- Content
View full analysis
/dev/null || true sleep 1 nohup node "$SCRIPT_DIR/scripts/ha-hub.js" start > "$SCRIPT_DIR/logs/hub.log" 2>&1 & HUB_PID=$! echo "$HUB_PID" > hub.pid disown $HUB_PID echo "Hub started with PID: $HUB_PID" ``` ### Technical Analysis `pkill -f` evaluates the complete command line of every process accessible to the invoking user. The pattern is not tied to this project directory, a verified executable path, or the PID recorded by this Skill. Any process whose command line contains `ha-hub.js start` can be terminated, including another installation, a test process, or an unrelated process whose arguments happen to contain the string. Suppressing all errors and continuing conceals whether an unintended process was killed. ### Attack Path 1. Another same-user process is running with `ha-hub.js start` somewhere in its command line. 2. The user or Agent invokes this project's `start.sh`. 3. `pkill -f` searches all accessible process command lines. 4. The unrelated process matches the broad pattern. 5. The operating system sends it a termination signal. 6. The script continues and starts the new hub without reporting the collateral termination. An attacker able to choose a victim process's command line could also deliberately include the matching string so that invoking this launcher terminates that process. ### Impact Assessment The issue can cause denial of service for unrelated processes owned by the same account. It does not directly grant higher operating-system privileges because `pkill` remains constrained by the caller's permissions, but it exceeds the minimum process-control scope required by the Skill. The affected scope includes every process the i ...[truncated 87 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (62)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill context is home automation, where undocumented or under-documented active control capabilities can have real-world effects on devices in a physical environment. If the skill can invoke Home Assistant services or run a persistent local control endpoint beyond what users reasonably infer from the description, users may grant trust or deploy it without understanding that it can change device state or trigger automations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill context is home automation, where undocumented or under-documented active control capabilities can have real-world effects on devices in a physical environment. If the skill can invoke Home Assistant services or run a persistent local control endpoint beyond what users reasonably infer from the description, users may grant trust or deploy it without understanding that it can change device state or trigger automations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The skill context is home automation, where undocumented or under-documented active control capabilities can have real-world effects on devices in a physical environment. If the skill can invoke Home Assistant services or run a persistent local control endpoint beyond what users reasonably infer from the description, users may grant trust or deploy it without understanding that it can change device state or trigger automations.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ha-cmd.js call climate.set_temperature entity_id=climate.hvac temperature=22 --dry-run
Static analysis
No suspicious patterns detected.