openhue
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the OpenHue CLI binary from the project's official GitHub releases (github.com/openhue/openhue-cli).
- [COMMAND_EXECUTION]: Provides instructions to set permissions and execute the openhue CLI tool for managing IoT devices.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests resource names (lights, rooms, scenes) from a physical Hue Bridge. If these names are maliciously crafted, they could potentially influence command execution during subsequent control operations.
- Ingestion points: Output of openhue get light, openhue get room, and openhue get scene commands in SKILL.md.
- Boundary markers: Not present; resource names are used directly in command arguments.
- Capability inventory: Executes shell commands via the openhue CLI.
- Sanitization: No explicit validation or escaping of resource names is defined in the instructions.
Audit Metadata