esphome-code-assistant
Pass
Audited by Gen Agent Trust Hub on Jun 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill is a well-structured developer aid for the ESPHome ecosystem, providing templates and component references.
- [EXTERNAL_DOWNLOADS]: The documentation in 'references/external-components.md' lists various third-party GitHub repositories as resources for specialized ESPHome functionality. These references are used for device-side firmware configuration and are not executed by the AI agent itself.
- [PROMPT_INJECTION]: The skill includes functionality for analyzing and converting Arduino source code from user snippets or provided GitHub URLs, creating a surface for indirect prompt injection. * Ingestion points: Source code from user-provided text or remote URLs enters the agent context for analysis ('references/arduino-conversion.md'). * Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the analyzed code. * Capability inventory: The agent can generate complex configurations and write them to files in the user's project directory ('SKILL.md'). * Sanitization: No specific sanitization of the input code is implemented. * Assessment: This capability is central to the skill's purpose and is assessed as safe as the agent maintains a specific conversion focus and requests confirmation for sensitive actions.
Audit Metadata