Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add IkarusMK/AIcortex --skill home-assistant-restgit clone --depth 1 https://github.com/IkarusMK/AIcortexWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ikarusmk/aicortex/home-assistant-rest)<a href="https://agentmods.dev/skills/ikarusmk/aicortex/home-assistant-rest"><img src="https://agentmods.dev/badge/skills/ikarusmk/aicortex/home-assistant-rest/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ikarusmk/aicortex/home-assistant-rest"><img src="https://agentmods.dev/badge/skills/ikarusmk/aicortex/home-assistant-rest.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00032 | $0.00383 |
| Opus 5.5 | $0.00013 | $0.00153 |
| Sonnet 5.5 | $0.00006 | $0.00077 |
| Haiku 4.5 | $0.00003 | $0.00038 |
Grade A, and why
home-assistant-rest scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Home Assistant over REST (via call_service)
When to use
Reading state or controlling devices in Home Assistant through this connector.
Setup (once)
Register HA as a service so the token stays server-side:
service_add(name="home-assistant",
base_url="http://<ha-ip>:8123",
token_env="HA_TOKEN") # then secret_set("HA_TOKEN", <long-lived token>)
Patterns
- Check it's alive:
call_service(service="home-assistant", path="api/")→{"message":"API running."} - Read a state:
GET api/states/<entity_id>(e.g.sensor.living_room_temp). - Call a service:
POST api/services/<domain>/<service>with a JSON body, e.g.path="api/services/light/turn_on",json_body={"entity_id":"light.kitchen","brightness_pct":40}.
Common domains
light (turn_on/off, brightness_pct, rgb_color) · switch · climate (set_temperature) ·
cover (open/close) · media_player · scene (turn_on) · automation (trigger).
Discipline
- Find the entity first (don't guess ids) — list
api/statesor search before acting. - Controlling a physical device is a state-changing action → confirm with the user first.
- Use
entity_id, never internal device ids, in service calls.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 35 lines · 32 tokens per session scan A d7276f3aaa86
home-assistant-rest is a skill published in the GitHub repository IkarusMK/AIcortex (10 stars, last pushed 20d ago), licensed Apache-2.0. It adds 32 tokens to every session and 383 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
API Catalog
Reference guide for connecting popular APIs to Home Assistant via Node-RED, YAML, or custom integrations. Covers authentication, endpoints, and complete working examples for: energy APIs (Tibber, Nordpool), weather (SMHI, OpenWeatherMap, yr.no), transport (SL, Trafikverket, Resrobot), smart home clouds (Shelly, Tuya…
ips-migration
Migrate an IP-Symcon object subtree between instances, or verify such a migration. Triggers: "IPS umziehen", "IP-Symcon auf neuen Rechner", "Subtree auf andere Instanz", "Config migrieren".
ips-cleanup
Audit and clean up an IP-Symcon system — recurring errors, red logs, instances in error state, dead objects. Triggers: "Fehler-Audit", "rote Logs", "tote Instanzen entfernen", "IPS-Health-Check".
zephyr-net-socket
Expert guidance for BSD sockets, TLS/DTLS secure sockets, and DNS resolution in Zephyr OS. Covers TCP/UDP socket programming, secure socket creation with mbedTLS, TLS credential management, hostname resolution with getaddrinfo/dnsresolve, mDNS/LLMNR support, and socket offloading. Use when implementing network…
ipsymcon
Inspect and modify an IP-Symcon system via the ipsymcon MCP — object tree, variables, PHP scripts, events, automations. Use for any Symcon/Hausautomation request. Changes are always planned first.
zephyr-netbuf
Expert guidance on Zephyr's Network Buffer (netbuf) subsystem for efficient data management. Use when the user asks about buffer pools, netbuf allocation, reference counting, data manipulation (add/push/pull/remove), buffer fragmentation, headroom/tailroom, or implementing protocol parsing/encoding in Zephyr…