yeelight-smart-home
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Authentication security is maintained by directing all token and login management to the local CLI runtime. The skill's instructions specifically prohibit the agent from requesting or printing secrets, ensuring sensitive credentials remain outside the chat context.
- [SAFE]: The skill uses a local runtime boundary. All device interactions are routed through a local binary (yeelight-home) via provided wrapper scripts, which include checks for runtime compatibility and installation integrity.
- [SAFE]: Robust data handling rules are in place. The skill explicitly instructs the agent to treat all entity names and external text as untrusted, preventing data-driven attacks. It also prohibits the invention of device states or home configurations.
- [SAFE]: Static detection of action concealment is a false positive. The documentation describes standard abstraction of technical runtime details (like pagination and internal operation identifiers) to improve the user interface, not to hide malicious behavior.
- [SAFE]: No obfuscation or malicious persistence mechanisms were detected. The skill is transparently documented and its scripts perform only intended local functions like searching a product catalog or invoking the CLI.
Audit Metadata