Home Assistant Hub

• Outcome: Review
• Latest audit: Jul 11, 2026 · 8:35 PM UTC
• Version: 1.5.1

Overview

Review before installing: this is a disclosed Home Assistant integration, but it handles broad home-control credentials and defaults to unencrypted Home Assistant traffic.

Install only if you are comfortable giving this skill broad Home Assistant visibility and some device-control ability. Change ha_url to HTTPS/WSS before adding a real token, restrict call_safe_domains to the smallest set you need, protect config/hub.json with local file permissions, rotate the Home Assistant token if exposed, and remember Telegram alerts may reveal household routines or occupancy.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The deliverer directly invokes the local Home Assistant on-demand service endpoint to call notify.send_message, despite the surrounding comment framing this as protected by a safe-domains policy. That policy is only documented in comments here and is not enforced by this script itself, so the process performs a privileged service call whenever config.tts_echo is enabled and a token is present.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The default Home Assistant URL uses plain HTTP, and the same base URL is converted to ws:// for WebSocket auth, causing the bearer token to be sent without transport encryption by default. On any network where traffic can be observed or intercepted, an attacker could steal the token and gain Home Assistant API access, which is especially dangerous in a home-automation context because it can expose sensors, presence, cameras, and potentially enable control of connected devices through other components.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The notification file is moved out of the pending queue before Telegram delivery succeeds. If the network request fails, the item is no longer pending and may never be retried, causing silent loss of alerts; in a home monitoring context, dropped safety or security notifications can materially reduce user awareness.

Credential Access

High

• Category: Privilege Escalation

Content

All secrets (`ha_token`, `telegram_bot_token`, `telegram_chat_id`) are stored in `config/hub.json`. This file is gitignored but:
- The HA token is a **long-lived bearer token** with broad API access — treat it like a password
- Default `ha_url` uses plain HTTP → credentials transmitted in cleartext on the local network. Use HTTPS if possible.
- Rotate tokens regularly via HA → Profile → Long-Lived Access Tokens

## 🔧 Process Management
The hub runs as background processes (`nohup`, `disown`) that persist beyond your session. `pkill -f "ha-hub.js start"` can match multiple processes. Always verify process state before killing.

• Confidence: 97% confidence
• Finding: Access Tokens

Session Persistence

Medium

• Category: Rogue Agent

Content

## ⚠️ Security Warning

You are about to create a **long-lived bearer token** with broad API access to your Home Assistant instance. Treat this token like a password:

- Never share it publicly or commit it to version control
- The file `config/hub.json` is gitignored — verify `.gitignore` includes it

• Confidence: 80% confidence
• Finding: create a **long-lived bearer token** with broad API access to your Home Assistant instance. Treat this token like a password: - Never share it publicly or commit it to version control - The file `con

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.