Home Assistant Toolkit

This skill appears to implement the Home Assistant management features it advertises, but there are a few important things to consider before enabling it: - Credentials requested: You only need either REST access (HA_URL + HA_TOKEN) OR SSH access (HA_HOST + SSH user/key or password). The registry metadata unnecessarily lists both methods and even marks HA_SSH_PASS/sshpass as required; you do not have to provide a password if you use key-based SSH or the REST token. Prefer key-based SSH and prefer REST API + a limited long-lived token when possible. - Sensitive secret placement: HA_TOKEN (long-lived access token) will be stored in your environment or in ~/.openclaw/openclaw.json. Treat it like a password and store it securely. If using HA_SSH_PASS and sshpass, be aware that sshpass exposes the password in process listings (/proc/*/cmdline); avoid password auth if you can. - Metadata vs runtime mismatch: The skill's metadata over-declares required binaries (sshpass) and env vars. That is likely a packaging/configuration error, not necessarily malicious, but ask the publisher or review SKILL.md and scripts if you need assurance that you won't be forced to supply extra credentials. - Host key handling: The SSH wrapper uses StrictHostKeyChecking=accept-new (TOFU). That eases first-time connection but accepts new host keys automatically; for high-security setups you should pre-populate known_hosts and not accept automatic trust. - What it does on your systems: The scripts will read/write files under your HA config path, run HA CLI commands (backups, restores, restarts), and download public release notes from GitHub. The skill writes generated docs into its own references/ directory. There are no calls to unknown third-party endpoints in the scripts reviewed. - Review and test: Because this skill executes shell commands against your Home Assistant instance, review the scripts and test in a non-critical environment or take a backup before performing destructive operations (restores, apply dashboard, etc.). Run the provided check-setup.sh first (SKILL.md mandates it) and verify the outputs before allowing any operations. If you want to proceed: supply only the minimum credentials needed for your chosen access method (REST token or SSH key), avoid HA_SSH_PASS/sshpass, and keep backups of your HA config. If you need higher assurance, ask the skill publisher to correct the metadata so required env vars/binaries reflect the real, conditional requirements.