Control NGBS iCON Smart Home thermostats. Use when the user asks about home temperature, heating, thermostat control, or wants to adjust room temperatures.

What to consider before installing: - Functionality: The skill legitimately needs your enzoldhazam.hu account credentials to list and set thermostats. Expect to provide credentials either via ENZOLDHAZAM_USER / ENZOLDHAZAM_PASS (env vars) or by using the CLI login which stores them in your OS keyring. - Metadata mismatch: The registry metadata lists no required env vars, but the README/SKILL.md and code do accept ENZOLDHAZAM_USER/ENZOLDHAZAM_PASS/ENZOLDHAZAM_SERIAL. Don't rely solely on the registry metadata — the skill will use credentials if provided. - Build/run risk: Installation requires cloning a GitHub repo and building a Go binary. Because the code runs locally, review the source (included in the skill) or run it in an isolated environment if you distrust the publisher. The included source appears to only communicate with https://www.enzoldhazam.hu and the Ax endpoint. - Keyring access: The CLI uses the system keyring to store credentials (via zalando/go-keyring). This is normal for convenience, but it means the program will call system credential APIs; if you prefer, use temporary environment variables instead of storing credentials in keychain. - Network behavior: All network calls in the code go to the stated domain (enzoldhazam.hu). There are no other external endpoints or obfuscated network calls in the provided source. - Operational caution: If you are uneasy about an agent invoking the CLI autonomously, consider restricting the skill's access or requiring explicit user confirmation (SKILL.md already advises confirming temperature changes). If you want extra safety, inspect the repository contents yourself before building and run the binary with least privilege or in a sandboxed environment.

Type: OpenClaw Skill Name: enzoldhazam Version: 1.0.1 The skill bundle is classified as suspicious due to the installation instructions in `SKILL.md` and `README.md` that require `sudo mv enzoldhazam /usr/local/bin/`. While this is a common practice for installing CLI tools globally, it represents a 'risky capability' or 'broad permission' as it requires elevated privileges. The Go source code itself appears benign, focused on controlling thermostats via `enzoldhazam.hu` and managing credentials securely via environment variables or macOS Keychain, without any other indicators of malicious intent such as data exfiltration, persistence, or prompt injection against the agent.