ClawHub
Back to skill

Security audit

py-homeassistant-cli

Security checks for vulnerabilities and agentic risk

Overview

This Home Assistant skill is not clearly malicious, but it handles powerful smart-home access in ways that deserve review before installation.

Install only if you are comfortable giving this skill broad Home Assistant authority. Use HTTPS, avoid passing tokens or alarm codes on the command line, prefer a dedicated least-privilege Home Assistant token, and treat service, template, presence, tracker, lock, alarm, garage, and Tesla location commands as sensitive actions requiring explicit user intent.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/homeassistant-cli.py:12
Finding

Long-Lived Home Assistant Bearer Token Can Be Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/homeassistant-cli.py:469
Finding

Authentication Secrets Are Accepted and Documented as Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (16)

Tainted flow: 'req' from os.environ.get (line 74, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/homeassistant-cli.py (reported line 35)May include surrounding context.

python
body = json.dumps(data).encode() if data is not None else None
    req = urllib.request.Request(url, data=body, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req) as resp:
            content = resp.read().decode()
            if content:
                return json.loads(content)

Tainted flow: 'req' from os.environ.get (line 74, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/homeassistant-cli.py (reported line 76)May include surrounding context.

python
body = json.dumps(data).encode() if data is not None else None
    req = urllib.request.Request(url, data=body, headers=headers, method=method)
    try:
        with urllib.request.urlopen(req) as resp:
            content = resp.read().decode()
            if content:
                return json.loads(content)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md
## Setup

1. Get a long-lived access token from Home Assistant (Profile → Long-Lived Access Tokens)

2. Configure via environment variables or command-line arguments:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/homeassistant-cli.py (reported line 492)May include surrounding context.

python
## Setup

1. Get a long-lived access token from Home Assistant (Profile → Long-Lived Access Tokens)

2. Configure via environment variables or command-line arguments:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md
## Setup

1. Get a long-lived access token from Home Assistant (Profile → Long-Lived Access Tokens)

2. Configure via environment variables or command-line arguments:

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented behavior goes far beyond a simple device-control CLI: it includes broad household discovery, presence and location lookups, template evaluation, history/logbook access, notifications, TTS, and Tesla-specific entity access. This scope expansion increases both privacy risk and operational risk because a user expecting basic control may unknowingly grant a tool access to sensitive telemetry and powerful automation surfaces.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The generic service command allows arbitrary Home Assistant service invocation with attacker-controlled JSON. In a Home Assistant environment, that can trigger sensitive actions well beyond simple device toggling, including locks, alarms, notifications, scripts, admin-like automations, and other integrations accessible to the token.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Arbitrary template evaluation exposes a powerful Home Assistant/Jinja introspection surface that can enumerate entities, metadata, areas, devices, and other sensitive state not implied by a simple control CLI. Depending on Home Assistant capabilities, templates may also be abused to access extensive contextual data and facilitate reconnaissance for later actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Tesla location and destination commands return precise latitude and longitude without friction, which can reveal real-time or intended vehicle location. In skill context, this is especially dangerous because it enables direct physical tracking of a person or household asset, far beyond normal device control expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly instructs users to pass a long-lived Home Assistant token on the command line. Command-line arguments are commonly exposed through shell history, process listings, audit logs, and system monitoring tools, which can leak the token to other local users or logging systems. In the context of a home automation CLI, a stolen token could allow broad control over devices, alarms, locks, and other sensitive automations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares environment and network capabilities in metadata but does not define an explicit tool/permission scope, reducing transparency about what runtime powers it needs. In a home-automation context, undeclared or overly broad capability use matters because the skill can read sensitive household state and invoke state-changing actions over the Home Assistant API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill exposes occupancy and tracker-based presence information, which can reveal whether people are home and may expose location-derived data. In a smart-home context this is privacy-sensitive and can materially aid stalking, burglary timing, or other misuse if invoked without clear user awareness and consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The generic service-call interface can invoke essentially any Home Assistant service with arbitrary JSON, bypassing the narrower safety guidance provided for specific high-risk domains like locks, alarms, and garage doors. In practice, this becomes a universal state-changing primitive that could disable security automations, unlock doors, open covers, or trigger dangerous household actions without any built-in confirmation or policy restriction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description frames the tool as a small device-control CLI, but the implementation includes broad surveillance and introspection features such as presence, calendars, history, logbook, weather, services, and template execution. That scope expansion increases the chance a user grants trust or tokens under a narrower mental model than the code actually warrants.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The presence command prints person and device_tracker states directly, exposing occupancy and movement information without any warning or scoping. In a household context, this is sensitive telemetry that can reveal who is home, away patterns, and indirectly daily routines.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The Tesla-specific commands embed personalized vehicle tracking capabilities inside a general-purpose Home Assistant CLI, including location and destination retrieval. This materially expands the data sensitivity of the tool and introduces targeted privacy risk unrelated to its advertised generic smart-home control role.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.