Trust Assessment
gohome received a trust score of 80/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Skill has broad control over smart home devices and gRPC methods, Unpinned dependency from GitHub repository.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Skill has broad control over smart home devices and gRPC methods The `gohome-cli` tool, which is part of this skill, provides commands to manage `roborock` devices and `tado` zones, and to `call` arbitrary gRPC methods. This grants the skill extensive control over connected smart home infrastructure and potentially other services exposed via gRPC. While the documentation mentions 'Only call write RPCs after explicit user approval', this is a guideline within the untrusted content and does not represent an enforced security control. Implement fine-grained access control for specific device types and RPC methods. Require explicit user confirmation for sensitive operations. Restrict the `call` command to a whitelist of safe RPCs or remove it if not strictly necessary. Ensure the LLM's execution environment enforces these restrictions. | LLM | SKILL.md:10 | |
| MEDIUM | Unpinned dependency from GitHub repository The Nix plugin `github:joshp123/gohome` is specified without a particular version, tag, or commit hash. This means that updates to the upstream repository could automatically be pulled, potentially introducing malicious code or vulnerabilities without explicit review. This constitutes an unpinned dependency, which is a supply chain risk. Pin the dependency to a specific commit hash or version tag (e.g., `github:joshp123/gohome/v1.2.3` or `github:joshp123/gohome?rev=abcdef123`). Regularly audit the upstream repository for security issues and update the pinned version only after review. | LLM | SKILL.md:17 |
Scan History
Embed Code
[](https://skillshield.io/report/382ca995bca92a5f)
Powered by SkillShield