Philips Hue Thinking Indicator

Visual AI activity indicator using Philips Hue lights. Pulse red when thinking, green when done.

What to consider before installing: - The package is missing the main 'hue' executable that the skill and README repeatedly reference. Do not install or run any 'hue' command until you obtain and inspect that executable. Ask the author to include the 'hue' script/source or provide a trustworthy install method (e.g., official Homebrew tap or GitHub release) so you can review it. - Do not run quick-setup.sh blindly: it POSTs to a hardcoded local IP (192.168.1.151). Use your bridge's actual IP and run a manually crafted curl command after verifying it is correct. Prefer manual registration steps documented by Philips Hue if unsure. - Do not copy hue-hooks.sh verbatim into your shell startup. Remove or edit the export PATH line that references /Users/jesse/... — that path is specific to the author and could cause unintended PATH changes on your machine. Instead create hooks/aliases that call the verified 'hue' binary location you control. - Before adding any scripts to PATH or running with elevated privileges, inspect the 'hue' binary (or its source) for network endpoints, unexpected remote URLs, or data-exfiltration patterns. If the 'hue' binary is a shell script, review it line-by-line; if it is a compiled binary, request source or a reproducible build. - If you cannot obtain the 'hue' executable for inspection, treat this package as incomplete and avoid installation. The inconsistencies suggest sloppy packaging at best and make security assessment impossible at worst. If the missing executable is provided and its code is limited to local Hue Bridge API calls (and hooks are sanitized), the skill appears coherent and low-risk. Without that file, however, the package is suspicious and should not be trusted until fixed and reviewed.

Type: OpenClaw Skill Name: philips-hue-thinking Version: 1.0.0 The skill bundle is benign. It provides functionality to control Philips Hue lights via a local HTTP API, which is its stated purpose. The `SKILL.md` and `README.md` contain clear instructions for setup and usage, without any evidence of prompt injection attempts to manipulate the AI agent for malicious purposes. The `hue-hooks.sh` and `quick-setup.sh` scripts use `curl` to interact with a local Philips Hue Bridge IP (e.g., `http://192.168.1.151/api`), which is expected for this functionality, and do not show any signs of data exfiltration, malicious execution, or persistence mechanisms.