Trust Assessment
homekit received a trust score of 84/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include HomeKit Pairing Credentials Stored Locally, Unpinned Python Dependencies.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | HomeKit Pairing Credentials Stored Locally The skill stores sensitive HomeKit device pairing credentials, including the Long Term Public Key (LTPK) and other pairing data, in an unencrypted JSON file (`pairings.json`) within the user's home directory (`~/.config/homekit/`). While necessary for the skill's functionality, this file contains critical data that, if compromised, could allow unauthorized control of paired HomeKit devices. Ensure the `pairings.json` file is created with restrictive file permissions (e.g., `0o600`) to prevent unauthorized access by other local users. Consider implementing encryption for the `pairings.json` file at rest if the environment allows for secure key management. | LLM | scripts/homekit.py:23 | |
| LOW | Unpinned Python Dependencies The `SKILL.md` documentation instructs users to install Python dependencies (`HAP-python`, `homekit`) without specifying exact versions. This practice can lead to supply chain risks, including unexpected behavior, compatibility issues, or the introduction of vulnerabilities if new versions of these libraries contain breaking changes or security flaws. Pin specific versions for all dependencies in a `requirements.txt` file (e.g., `HAP-python==X.Y.Z`, `homekit==A.B.C`) and instruct users to install from this file (`pip install -r requirements.txt`). Regularly review and update pinned versions. | LLM | SKILL.md:18 |
Scan History
Embed Code
[](https://skillshield.io/report/559e7843f5881598)
Powered by SkillShield