home-assistant-ops
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
sshto execute commands on a remote Home Assistant host andcurlto interact with the Home Assistant REST API. This is the primary intended function of the skill. - [EXTERNAL_DOWNLOADS]: Network operations are performed via
curlto a user-configured API endpoint (api_url) to retrieve states and call services. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that could be influenced by an attacker to manipulate agent behavior.
- Ingestion points: Entity states via the
/api/statesendpoint, system logs viahome-assistant.log, and configuration files likeautomations.yaml. - Boundary markers: The skill does not provide specific instructions or delimiters to the agent to distinguish between its instructions and potentially malicious content within the ingested data.
- Capability inventory: The skill possesses significant capabilities, including executing remote commands via SSH, calling any available Home Assistant service (e.g., controlling hardware, restarting the core), and modifying local configuration files.
- Sanitization: No mechanisms are described for sanitizing, validating, or filtering the data received from the Home Assistant instance before it is processed by the agent.
Audit Metadata