ESPHome

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation and templates reference numerous community-developed software components and fonts hosted on well-known services.
  • Evidence (references/external-components.md): Multiple URIs using the github:// scheme (e.g., github://DomiStyle/esphome-panasonic-ac).
  • Context: These are standard ESPHome extensions used to support specific hardware. They are documented neutrally as intended extensions for the platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze user-supplied hardware specifications and can be asked to convert code from external repositories.
  • Evidence (references/arduino-conversion.md): Instructions for the agent to analyze the structure and logic of existing Arduino projects provided via GitHub URLs.
  • Context: This functionality represents the skill's primary purpose but inherently creates a surface where malicious external data could attempt to influence the agent's logic. The skill includes robust templates and safety checks to mitigate these risks.
  • [SAFE]: The skill includes comprehensive security hardening documentation and promotes safe credential management.
  • Evidence (references/security-hardening.md): Checklists for enabling API encryption, setting OTA passwords, and using secrets.yaml to ensure no hardcoded sensitive information is present in the final configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 07:51 PM