yeelight-wifi-lan-control
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for local-first operation and explicitly restricts network communication to private and link-local IPv4 addresses, preventing unauthorized external data exfiltration.
- [DATA_EXPOSURE]: All internal identifiers (device IDs, room IDs, group IDs, etc.) are sanitized using SHA-256 hashing ('opaqueRef') before being returned to the AI context, effectively preventing the exposure of raw protocol identifiers and mitigating indirect prompt injection risks.
- [COMMAND_EXECUTION]: The skill requires explicit user confirmation ('executionRequested: true' and 'preview: false') for all physical device writes and persistent storage modifications, ensuring the user remains in control of the automation.
- [DYNAMIC_EXECUTION]: No evidence of unsafe dynamic code execution or remote script loading was found. The skill uses standard Node.js built-in modules and performs strict schema validation on all processed JSON data.
- [PERSISTENCE]: The skill manages a private local store with appropriate file permissions (0o600 for files, 0o700 for directories) and specifically avoids installing system-level persistence mechanisms like cron or daemons.
Audit Metadata