ESPHome
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation and templates reference numerous community-developed software components and fonts hosted on well-known services.
- Evidence (references/external-components.md): Multiple URIs using the
github://scheme (e.g.,github://DomiStyle/esphome-panasonic-ac). - Context: These are standard ESPHome extensions used to support specific hardware. They are documented neutrally as intended extensions for the platform.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-supplied hardware specifications and can be asked to convert code from external repositories.
- Evidence (references/arduino-conversion.md): Instructions for the agent to analyze the structure and logic of existing Arduino projects provided via GitHub URLs.
- Context: This functionality represents the skill's primary purpose but inherently creates a surface where malicious external data could attempt to influence the agent's logic. The skill includes robust templates and safety checks to mitigate these risks.
- [SAFE]: The skill includes comprehensive security hardening documentation and promotes safe credential management.
- Evidence (references/security-hardening.md): Checklists for enabling API encryption, setting OTA passwords, and using
secrets.yamlto ensure no hardcoded sensitive information is present in the final configuration.
Audit Metadata