gtapps/ha-safety-audit
plugins/claude-code-homeassistant-hermit/skills/ha-safety-audit/SKILL.md
Audit all live Home Assistant automations and scripts against the safety policy. Catches policy drift from entities added via the HA UI that bypassed this plugin's safety gate. Runs weekly as a scheduled check via reflect --scheduled-checks.
$ install --global
skillsauthnpx skillsauth add gtapps/claude-code-hermit ha-safety-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 3, 2026, 5:20 AM200.2s1 file scanned
SKILL.md
- name:
- ha-safety-audit
- description:
- Audit all live Home Assistant automations and scripts against the safety policy. Catches policy drift from entities added via the HA UI that bypassed this plugin's safety gate. Runs weekly as a scheduled check via reflect --scheduled-checks.
HA Safety Audit
Purpose
The plugin's safety gate only runs when automations are built through ha-build-automation. Automations and scripts added directly via the HA UI bypass it. This skill re-audits every live automation and script against the current safety policy and surfaces violations so the operator can review them.
Violations listed in .claude-code-hermit/compiled/acknowledged-violations.md (under automation_ids or script_ids) are suppressed from the actionable findings and reported separately as acknowledged.
Steps
- Run
${CLAUDE_PLUGIN_ROOT}/bin/ha-agent-lab ha audit-automations. - Run
${CLAUDE_PLUGIN_ROOT}/bin/ha-agent-lab ha audit-scripts. - Each command writes JSON + markdown artifacts under
.claude-code-hermit/raw/audit-ha-safety-*and.claude-code-hermit/raw/audit-ha-script-safety-*and prints a stdout findings block. - Concatenate the two stdout blocks with a blank separator line and pass the result through unchanged — reflect --scheduled-checks consumes it as the scheduled check output.
Output contract
Each CLI command prints a block in this shape:
ha-safety-audit findings — YYYY-MM-DD
Policy violations: N
- <alias> (`<id>`): <reasons>
No action needed: M automations passed
Acknowledged (suppressed): K
Scripts use ha-script-safety-audit findings — YYYY-MM-DD as the first line and scripts in place of automations.
If no violations: No actionable findings. (N automations scanned) or No actionable findings. (N scripts scanned).
Failure modes
- HA unreachable → CLI exits non-zero with an error message. Treat that as "skipped, cannot audit" in reflect --scheduled-checks context; do not retry automatically.
- No automations or scripts configured →
No actionable findings. (0 automations/scripts scanned)— not an error.
Related Skills
gtapps/fitness-brief
tools
VerifiedTrustedCommunity
Composes and delivers the daily fitness brief — a forward-looking morning read (readiness + today's plan) or a backward-looking evening read (today's training, or an earned-rest note, + tomorrow's setup) — in the operator's configured voice. Invoke with /claude-code-fitness-hermit:fitness-brief --morning|--evening|--slot <name>. Becomes the plugin's two daily beats — the morning Strava connectivity check and the evening activity sync, RPE binding, and Run deep-dive.
68SKILL.mdUpdated Jul 25, 2026
gtapps/relogin
development
VerifiedTrustedCommunity
Renew the hermit's long-lived Claude login token over the channel, before it expires. Relays a one-time sign-in link to the operator, takes the code back, installs the new token, and restarts. Activates on messages like 'relogin', 'renew my login', 'reauth', 'the login is expiring', or when doctor's credential-expiry check flags setup-token.
68SKILL.mdUpdated Jul 22, 2026
gtapps/weekly-digest
development
VerifiedTrustedCommunity
Synthesizes the past 7 days of archived briefs into a weekly digest — top stories, emerging vs faded themes, category activity, and per-source performance built from archive frontmatter. Delivers to the operator's configured channel and archives a weekly note. Designed as a weekly routine. Invoke with /feed-hermit:weekly-digest.
68SKILL.mdUpdated Jul 21, 2026
gtapps/story-arcs
development
VerifiedTrustedCommunity
Manage developing story arcs tracked across briefs — add, resolve, and list active arcs in compiled/story-arcs-*.md. Arc Watch keywords drive the feed-brief arc-tagging enrichment. Invoke with /feed-hermit:story-arcs add|resolve|list.
68SKILL.mdUpdated Jul 21, 2026