homematic
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a Node.js helper script (
homematic.cjs) to handle complex protocol logic for the Homematic IP Connect API, including WebSocket communication and credential enrollment. - [SAFE]: The skill implements a robust credential management strategy. It uses platform-managed secret placeholders (e.g.,
<secret:HOMEMATIC_HCU_AUTH_TOKEN>) and environment variables, and the helper script explicitly rejects sensitive values if they are passed as command-line flags to prevent exposure in shell history. - [SAFE]: A 'stakes tier' system (green, amber, red) is enforced to manage risk. Read-only operations are classified as green, while device controls are amber, and security-critical actions (like acknowledging alarms) are red, requiring explicit operator grants and confirmation.
- [SAFE]: Network operations are restricted to the user-provided HCU URL and follow the official Connect API protocol. The skill includes logic to validate that sensitive operations use secure transports and gateway-managed secrets rather than ad-hoc scripts.
- [EXTERNAL_DOWNLOADS]: The helper script optionally relies on the well-known
ws(WebSocket) npm package for local smoke testing, but defaults to gateway-managed transports for standard agent operations.
Audit Metadata