中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 15/100
Last scan:1 day ago Rescan
15 /100
haos-ssh-maintenance
Use when Home Assistant OS needs SSH-based maintenance that cannot be completed cleanly through the Home Assistant API alone.
Pure documentation skill for HAOS SSH maintenance with no executable code, properly declared permissions, and appropriate boundary controls.
Skill Namehaos-ssh-maintenance
Duration33.7s
Enginepi
✓
Safe to install
This skill is a documentation-only guide. No executable code is present. Ensure any SSH access targets are properly secured and audit trail is maintained for configuration changes.

Findings 2 items

Severity Finding Location
Low
Broad .storage edit policy Priv Escalation
The .storage direct-edit policy mentions editing core.config_entries without specific safeguards beyond 'last resort' framing. Editing critical configuration entries like device_registry could have wide-ranging effects.
- /config/.storage/core.config_entries
→ Add explicit safeguards: require user confirmation for core.config_entries, core.device_registry, and core.entity_registry edits. Suggest backup and rollback procedures before any .storage modification.
 SKILL.md:96
Low
Interactive SSH shell access without specific constraints Sensitive Access
Interactive PTY-backed SSH sessions provide shell access that could execute arbitrary commands beyond documented ha CLI usage.
When running from OpenClaw, prefer a PTY-backed exec session and then send commands into the live SSH shell.
→ Clarify the command scope for interactive SSH. While the skill focuses on ha CLI, PTY sessions technically allow arbitrary shell commands not bounded by documentation.
 SKILL.md:59
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned SKILL.md mentions editing YAML files under /config, custom_components, .storage …
Shell WRITE WRITE ✓ Aligned SKILL.md describes one-shot and interactive SSH modes for ha CLI and file operat…
Network READ READ ✓ Aligned SKILL.md mentions API logbook/history access, Home Assistant UI logs
Environment READ READ ✓ Aligned SKILL.md mentions 'environment inspection' for one-shot SSH
Skill Invoke NONE NONE — No skill invocation capability used or declared
Clipboard NONE NONE — No clipboard access mentioned or used
Browser NONE NONE — No browser automation mentioned
Database READ READ ✓ Aligned SKILL.md mentions /config/home-assistant_v2.db as a read target

File Tree

1 files · 5.5 KB · 165 lines
Markdown 1f · 165L
└─ 📝 SKILL.md Markdown 165L · 5.5 KB

Security Positives

✓ No executable code present - this is a pure documentation skill
✓ All declared capabilities are appropriate and documented
✓ Good security posture: 'Read before editing', 'smallest possible region', 'Ask before changing behavior that affects locks, alarms, access control'
✓ API-first approach explicitly recommended before falling back to SSH
✓ Safety guidelines for physical-entry-affecting systems included
✓ Clear distinction between one-shot and interactive SSH modes
✓ Reporting requirements ensure audit trail for configuration changes
✓ No obfuscation, no base64, no suspicious patterns detected
✓ No credential harvesting, no data exfiltration, no external network calls