Philips Hue

Local control of Philips Hue lights via API v1.

This skill appears to do exactly what it says: control a local Philips Hue Bridge using a small shell script. Before installing: (1) review hue.sh (it’s short and readable) and confirm it will call only your local BRIDGE_IP; (2) understand the script expects a .env file in the skill directory with BRIDGE_IP and USERNAME (Hue API key) — do not put other secrets there; (3) the SKILL.md/metadata mention jq but the script doesn't use it (safe but unnecessary); (4) pair your bridge by pressing its physical button as documented; (5) run the script with minimal privileges (don’t run as root) and ensure your Hue Bridge is on a trusted LAN segment (don’t expose it to the Internet). If you want extra assurance, run the script in a controlled environment and monitor network calls to ensure no unexpected external endpoints are contacted.

Type: OpenClaw Skill Name: philips-hue Version: 1.0.1 The `hue.sh` script contains a critical Python code injection vulnerability. User-supplied hex color values are directly interpolated into a `python3` script within the `hex_to_hsb` function without proper sanitization. This allows an attacker to inject and execute arbitrary Python code on the host system, leading to Remote Code Execution (RCE). While the skill's stated purpose is benign, this severe input sanitization flaw makes it suspicious due to the potential for exploitation.