skills/steipete/openclaw/openhue/Gen Agent Trust Hub

openhue

Pass

Audited by Gen Agent Trust Hub on Jul 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill automates the installation of the openhue-cli binary using the Homebrew package manager from the openhue/cli/openhue-cli tap.
  • [COMMAND_EXECUTION]: The skill performs its primary functions by executing shell commands via the openhue binary. It uses various subcommands like get and set to interact with local hardware.
  • [PROMPT_INJECTION]: The skill processes user-supplied strings (such as room names, scene names, or light labels) and interpolates them directly into shell command arguments. This creates a surface for indirect prompt injection or command argument injection if a user provides input containing shell control characters or unexpected flags, although the impact is generally restricted to the context of light control.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 13, 2026, 02:10 PM
Security Audit — agent-trust-hub — openhue