samsung-smart-tv
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The setup script uses subprocess.run to call the SmartThings CLI for provisioning applications and listing devices. The commands are constructed using static arguments or paths derived from the local environment.
- [EXTERNAL_DOWNLOADS]: When the SmartThings CLI is not found locally, the skill uses npx to fetch and execute the official @smartthings/cli package from the npm registry.
- [SAFE]: OAuth tokens and application secrets are stored in a .env file located in a dedicated state directory (~/.clawdbot/). The script explicitly sets file permissions to 0600 (owner-only access) to protect these secrets.
- [SAFE]: The skill uses https://httpbin.org/get as the default redirect URI for the OAuth authorization flow. This is a common pattern for CLI tools to allow users to manually capture the authorization code from the browser's address bar without requiring a local web server.
Audit Metadata