Homeassistant Skill

Control Home Assistant devices and automations via REST API. 25 entity domains including lights, climate, locks, presence, weather, calendars, notifications, scripts, and more. Use when the user asks about their smart home, devices, or automations.

Install only if you want an agent to access your Home Assistant instance. Use the least-privileged Home Assistant account or token available, protect HA_TOKEN like a password, revoke it when no longer needed, and require explicit confirmation before actions involving locks, alarms, garage doors, gates, security automations, presence/location, calendars, history, logbook, scripts, scenes, or broad service calls.

Type: OpenClaw Skill Name: homeassistant-skill Version: 2.1.0 The skill provides extensive capabilities to control a Home Assistant instance, including critical functions like locking/unlocking doors, arming/disarming alarms, and opening/closing garage doors. While the `SKILL.md` includes explicit 'Safety Rules' instructing the agent to confirm these actions with the user, these are markdown instructions, not programmatic safeguards. An agent susceptible to prompt injection could be instructed to bypass these safety rules, leading to unauthorized physical access or security compromise. The skill itself does not exhibit malicious intent (e.g., data exfiltration to external endpoints, obfuscation, persistence mechanisms), but its broad, high-impact capabilities, coupled with reliance on agent interpretation for safety, classify it as suspicious.