← Back to Skills Marketplace
718
Downloads
0
Stars
2
Active Installs
2
Versions
Install in OpenClaw
/install philips-hue
Description
Local control of Philips Hue lights via API v1.
Usage Guidance
This skill appears to do exactly what it says: control a local Philips Hue Bridge using a small shell script. Before installing: (1) review hue.sh (it’s short and readable) and confirm it will call only your local BRIDGE_IP; (2) understand the script expects a .env file in the skill directory with BRIDGE_IP and USERNAME (Hue API key) — do not put other secrets there; (3) the SKILL.md/metadata mention jq but the script doesn't use it (safe but unnecessary); (4) pair your bridge by pressing its physical button as documented; (5) run the script with minimal privileges (don’t run as root) and ensure your Hue Bridge is on a trusted LAN segment (don’t expose it to the Internet). If you want extra assurance, run the script in a controlled environment and monitor network calls to ensure no unexpected external endpoints are contacted.
Capability Analysis
Type: OpenClaw Skill
Name: philips-hue
Version: 1.0.1
The `hue.sh` script contains a critical Python code injection vulnerability. User-supplied hex color values are directly interpolated into a `python3` script within the `hex_to_hsb` function without proper sanitization. This allows an attacker to inject and execute arbitrary Python code on the host system, leading to Remote Code Execution (RCE). While the skill's stated purpose is benign, this severe input sanitization flaw makes it suspicious due to the potential for exploitation.
Capability Assessment
Purpose & Capability
The name/description match the provided code: hue.sh implements local Philips Hue API v1 calls. Minor inconsistency: SKILL metadata and SKILL.md list 'jq' as a required binary, but the script does not call jq. Also, registry 'required env vars' is empty while SKILL.md instructs the user to create a local .env with BRIDGE_IP and USERNAME (this is a local config file, not platform-level env vars).
Instruction Scope
SKILL.md instructs only local setup (press bridge button, create .env) and use of hue.sh. The script sources .env from its own directory and performs HTTP calls to the local bridge IP only. There are no instructions to read unrelated files, access other system configs, or transmit data to external endpoints.
Install Mechanism
No install spec (instruction-only skill) and the included hue.sh is bundled with the skill. Nothing is downloaded or extracted from external URLs; risk from install mechanism is low.
Credentials
The skill requires BRIDGE_IP and USERNAME (Hue API key) stored in a local .env file — appropriate and proportionate for local Hue control. The registry declares no required platform env vars, which matches that secrets are stored in a local .env rather than requested from the platform. Minor mismatch: SKILL.md/metadata lists 'jq' as required though it's unused.
Persistence & Privilege
The skill does not request persistent platform privileges (always: false). It doesn't modify other skills or system-wide settings and only reads a .env from its own directory. Autonomous invocation is allowed by default (normal) but not combined with other concerning behavior.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install philips-hue - After installation, invoke the skill by name or use
/philips-hue - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Added support for controlling lights using HTML hex color codes (e.g., "#3399FF").
- Updated prerequisites to include `python3` alongside `curl` and `jq`.
- Expanded documentation to clarify usage of named and hex color codes.
- Minor clarifications in installation and usage instructions.
v1.0.0
Initial release of the Philips Hue Skill.
- Provides local control of Philips Hue lights using the Bridge and API v1.
- Supports turning lights on/off, adjusting brightness, changing colors, and chaining multiple actions in one command.
- Easy setup with `.env` configuration and pairing instructions.
- Includes a shell script (`hue.sh`) for fast and flexible command-line control.
- Documentation details supported features and usage examples.
Metadata
Frequently Asked Questions
What is Philips Hue?
Local control of Philips Hue lights via API v1. It is an AI Agent Skill for Claude Code / OpenClaw, with 718 downloads so far.
How do I install Philips Hue?
Run "/install philips-hue" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Philips Hue free?
Yes, Philips Hue is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Philips Hue support?
Philips Hue is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Philips Hue?
It is built and maintained by Aprilox (@aprilox); the current version is v1.0.1.
More Skills