mcp-hass
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows established patterns for integrating smart home systems with AI agents using the Model Context Protocol.
- [EXTERNAL_DOWNLOADS]: Downloads and executes the mcporter package from the npm registry using npx. This is a common utility for bridging MCP calls to external services.
- [COMMAND_EXECUTION]: Utilizes shell commands to configure API access and invoke device services like turning lights and fans on or off.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external state data from Home Assistant, which serves as a potential ingestion point for indirect prompt injection. 1. Ingestion points: Data is ingested through the home-assistant.GetLiveContext tool output. 2. Boundary markers: No explicit instruction delimiters are defined. 3. Capability inventory: The skill can execute shell commands and modify physical device states via mcporter. 4. Sanitization: No specific input sanitization or output validation is described in the prompt.
Audit Metadata