Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package is a Home Assistant smart-home control skill. It provides documentation and a bash CLI wrapper that reads a Home Assistant URL and long-lived access token from a local config file or environment variables, then sends authenticated REST API calls to that URL. The wrapper can list or search entity states, turn devices on/off or toggle them, activate scenes, run scripts, trigger automations, set climate temperatures, and call arbitrary Home Assistant services. Outbound credential-bearing API calls target the user-configured HA_URL; no hidden endpoints, download-and-execute, or obfuscated code was found. The package's own skill card warns that it uses long-lived credentials and can affect sensitive devices such as locks, alarms, and garage doors. This is rated CAUTION because a careful user should review the broad control and credential exposure before install.
| Declared purpose | Control Home Assistant smart home devices, run automations, and receive webhook events. |
| Observed behavior | scripts/ha.sh requires HA_URL and HA_TOKEN, loads them from $HOME/.config/home-assistant/config.json unless environment variables are set, and uses curl with an Authorization Bearer header to call the Home Assistant REST API. Commands include state/states, on/off/toggle, scene, script, automation/trigger, climate, list, search, call, and info. It uses jq to parse responses and redirects some output to /dev/null. The documentation also describes inbound webhooks from Home Assistant to a Clawdbot URL and a WebSocket API. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: HA_TOKEN |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Sends authenticated HTTPS requests to the user-configured Home Assistant URL (HA_URL) using curl; documentation also describes inbound webhooks and WebSocket. |
| shell | needed | Uses bash command examples and the scripts/ha.sh CLI wrapper to run curl and jq. |
| filesystem_read | needed | Reads $CONFIG_FILE, which defaults to $HOME/.config/home-assistant/config.json, to load HA_URL and HA_TOKEN. |
| credentials | needed | Uses a long-lived Home Assistant access token from the config file or HA_TOKEN environment variable and sends it as a Bearer token. |
| filesystem_write | exceeds purpose | No persistent file writes were observed; several commands redirect output to /dev/null rather than saving files. |
| severity | finding |
|---|---|
| info | Declared purpose The skill declares control of Home Assistant devices, automations, scripts, scenes, and inbound webhooks. SKILL.md:3 description: Control Home Assistant smart home devices, run automations, and receive webhook events. Use when controlling lights, switches, climate, scenes, scr |
| info | Required binaries The skill metadata declares that curl and jq must be available in the execution environment. SKILL.md:4 metadata: {"clawdbot":{"emoji":"🏠","requires":{"bins":["jq","curl"]}}} |
| low | Setup example uses plain HTTP The documented environment-variable setup uses an unencrypted http:// URL for Home Assistant. If followed outside an isolated local network, the Bearer token could be exposed in transit. SKILL.md:26 export HA_URL="http://homeassistant.local:8123" |
| info | Long-lived access token The skill expects a long-lived Home Assistant access token. This credential is sensitive and is stored in the environment or config file. SKILL.md:27 export HA_TOKEN="your-long-lived-access-token" |
| info | Authenticated REST API request The skill sends the Home Assistant token as a Bearer credential to the configured HA_URL. This is required for its stated purpose. SKILL.md:42 curl -s -H "Authorization: Bearer $HA_TOKEN" "$HA_URL/api/states" | jq '.[].entity_id' |
| low | Device control example The documentation shows turning on a light via the Home Assistant service API. The wrapper generalizes this to many device types. SKILL.md:56 "$HA_URL/api/services/light/turn_on" -d '{"entity_id": "light.living_room"}' |
| low | Inbound webhook can trigger agent action External Home Assistant webhook data can lead to notifications or agent actions. This is part of the declared bidirectional design, but users should scope and validate incoming webhook payloads. SKILL.md:130 Clawdbot receives the webhook and can notify you or take action based on the event. |
| info | Local config file location The script reads its configuration from $HOME/.config/home-assistant/config.json unless HA_CONFIG overrides it. scripts/ha.sh:7 CONFIG_FILE="${HA_CONFIG:-$HOME/.config/home-assistant/config.json}" |
| low | Loads bearer token from config file The script reads the long-lived token from the JSON config file when HA_TOKEN is not already set. No permission check or encryption is performed. scripts/ha.sh:12 HA_TOKEN="${HA_TOKEN:-$(jq -r '.token // empty' "$CONFIG_FILE")}" |
| info | Central authenticated API helper All API calls made by the wrapper use this helper, which attaches the token and JSON content type to curl requests. scripts/ha.sh:22 curl -s -H "Authorization: Bearer $HA_TOKEN" -H "Content-Type: application/json" "$@" |
| medium | Arbitrary Home Assistant service call The 'call' command can invoke any Home Assistant service with arbitrary JSON data. With a privileged token this could affect locks, alarms, garage doors, climate, media players, scripts, automations, or notification services. scripts/ha.sh:132 api -X POST "$HA_URL/api/services/$domain/$service" -d "$data" |
| low | Documented plaintext WebSocket URL The reference shows an unencrypted ws:// endpoint. If used as written, WebSocket authentication credentials would travel without TLS protection. references/api.md:151 For real-time updates, use the WebSocket API at `ws://ha-url/api/websocket`. |
| low | WebSocket auth uses access token The WebSocket flow authenticates with the same long-lived access token. Users should use wss:// rather than ws:// to protect it. references/api.md:156 3. Send `{"type": "auth", "access_token": "TOKEN"}` |
| medium | Publisher discloses broad control and credentials The publisher's own risk statement confirms the skill's broad control capability and use of long-lived credentials. skill-card.md:24 Risk: The skill can issue broad smart-home control actions and uses long-lived Home Assistant credentials. |
| medium | Sensitive device control possible The skill-card acknowledges that commands can affect safety- and security-relevant devices. The script itself does not add confirmation or allow-list restrictions. skill-card.md:28 Risk: Commands may affect sensitive devices such as locks, alarms, garage doors, covers, climate systems, scripts, or automations. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| homeassistant.local | not in the service index | SKILL.md:26 |
| your-ha-instance.duckdns.org | not in the service index | SKILL.md:18 |
| Binaries invoked | bash, curl |
| Environment variables read | CONFIG_FILE, HA_CONFIG, HA_TOKEN, HA_URL, HOME |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 8 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 175 | dc73a1a85ace02ac… |
_meta.json | 6 | c65abfca1e61e878… |
references/api.md | 175 | 662a52be9014dbf1… |
scripts/ha.sh | 172 | ce9de035fe7a6caf… |
skill-card.md | 56 | 715a63fa5a45f968… |
For agents
JSON: https://agenteconomy.report/k/home-assistant.audit.json · badge: https://agenteconomy.report/k/home-assistant.audited.svg ·
skill rating: /k/home-assistant · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).