yeelight-wellness-lighting
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches weather, geocoding, and solar information from well-known services such as Open-Meteo and OpenWeather. These network operations are strictly limited to hardcoded API endpoints and are used solely to provide the environmental context required for seasonal lighting adjustments.- [COMMAND_EXECUTION]: The skill interacts with the local environment by executing the yeelight-home CLI, a vendor-specific tool for managing smart lighting devices. It also uses system utilities like open or xdg-open to display generated wellness reports, which is a standard part of its reporting functionality.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from weather APIs and user-supplied city names. It mitigates potential injection risks through a comprehensive security strategy:
- Ingestion points: Weather and geocoding data fetched in scripts/resolve-public-context.mjs and user-provided locations in SKILL.md.
- Boundary markers: Explicit instructions in SKILL.md and references/public-context.md mandate that all provider-supplied content be treated as untrusted data rather than instructions.
- Capability inventory: Subprocess calls to the yeelight-home CLI for lighting control and system utilities for report viewing.
- Sanitization: Implements strict JSON schema validation in scripts/public-context-envelope.mjs to ensure all external data conforms to expected types and ranges.- [DATA_EXFILTRATION]: The skill includes defensive logic to prevent accidental data leaks. The reporting engine in scripts/render-report.mjs uses regular expressions to identify and remove sensitive patterns, such as Bearer tokens, private keys, and high-precision geographic coordinates, before displaying results to the user.
Audit Metadata