skills/tt-a1i/hermes-agent/openhue/Gen Agent Trust Hub

openhue

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches the OpenHue CLI binary from the project's official GitHub releases (github.com/openhue/openhue-cli).
  • [COMMAND_EXECUTION]: Provides instructions to set permissions and execute the openhue CLI tool for managing IoT devices.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests resource names (lights, rooms, scenes) from a physical Hue Bridge. If these names are maliciously crafted, they could potentially influence command execution during subsequent control operations.
  • Ingestion points: Output of openhue get light, openhue get room, and openhue get scene commands in SKILL.md.
  • Boundary markers: Not present; resource names are used directly in command arguments.
  • Capability inventory: Executes shell commands via the openhue CLI.
  • Sanitization: No explicit validation or escaping of resource names is defined in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 12:48 PM
Security Audit — agent-trust-hub — openhue