xiaomi-home-assistant-skill

• Analyzed: May 11, 2026, 4:35 AM
• Findings: 1
• Version: 1.0.4
• Hash: e397f2a859b959491ce5fdfc35b553b0c107d97efc7b181aad6fe8b4e1325964
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as benign. It transparently integrates with Home Assistant for device monitoring and control, as described in `SKILL.md` and `README.md`. All network requests are directed to the user-configured Home Assistant URL, and file access is limited to its own configuration files (`config.json`). There is no evidence of data exfiltration, persistence mechanisms, arbitrary command execution, or prompt injection attempts against the agent in `SKILL.md`. While `homeassistant_auth.json` is declared as a required file but not directly used by the Python code (the token is read from `config.json`), and `monitoring.py` allows a config path via `sys.argv[1]` when run standalone, these are minor inconsistencies or potential vulnerabilities, not indicative of malicious intent.