ha-quality-scale-verify
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches official rule documentation from the Home Assistant developer documentation repository on GitHub.
- [EXTERNAL_DOWNLOADS]: It retrieves integration-specific guidelines from the official Home Assistant website's source repository on GitHub.
- [EXTERNAL_DOWNLOADS]: The skill fetches package metadata from the official PyPI registry to verify integration dependencies.
- [PROMPT_INJECTION]: The skill processes external documentation and metadata, which creates a potential surface for indirect prompt injection.
- Ingestion points: Fetches markdown documentation from
github.com/home-assistant/developers.home-assistantandgithub.com/home-assistant/home-assistant.io, and JSON metadata frompypi.org. - Boundary markers: None present; the skill treats fetched content as authoritative rules for verification.
- Capability inventory: The skill performs read operations on local integration files (manifests, Python modules, YAML config) and reports findings. It does not possess capabilities for code execution, system modification, or external data transmission beyond the agent's response.
- Sanitization: No specific sanitization or validation of the fetched external content is described.
Audit Metadata