Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add omarshahine/HomeClaw --skill homekitgit clone --depth 1 https://github.com/omarshahine/HomeClawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/omarshahine/homeclaw/homekit)<a href="https://agentmods.dev/skills/omarshahine/homeclaw/homekit"><img src="https://agentmods.dev/badge/skills/omarshahine/homeclaw/homekit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/omarshahine/homeclaw/homekit"><img src="https://agentmods.dev/badge/skills/omarshahine/homeclaw/homekit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 343 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 344 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Tool Misuse · line 184 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00108 | $0.06190 |
| Opus 5 | $0.00054 | $0.03095 |
| Sonnet 5 | $0.00022 | $0.01238 |
| Haiku 4.5 | $0.00011 | $0.00619 |
Grade A, and why
homekit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 528 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HomeKit Control
Golden Rule: Device Map First
Before your first HomeKit action in a session, read memory/homekit-device-map.json.
This compact device map has every device as a flat list with display_name, id (UUID), room, type (semantic category), controls (writable characteristics), and state. It's optimized for fast LLM scanning and disambiguation.
Refresh the cache periodically or when devices may have changed:
homeclaw-cli device-map --format agent -o memory/homekit-device-map.json
Resolving What the User Means
- Match user's words against
display_nameandroomfrom the cached map - Use
typeto disambiguate —lightingdevices support brightness;powerdevices are on/off only. A "Closet Light" withtype: powercannot dim. - If ambiguous, prefer the device in the most likely room (main living areas > bedrooms > outdoor)
- If still ambiguous, ask
- Always use UUIDs for write operations — many devices share names (9 "Overhead" lights, multiple "Blinds"). Use
display_namefor reading,id(UUID) forset,import-scene, andautomations createcommands - Check
controlsbefore sending a command — ifbrightnessisn't incontrols, don't try to set it - If no match found, refresh the cache first — devices may have been added/renamed:
Then retry the match. Only tell the user "device not found" if it's still missing after refresh.homeclaw-cli device-map --format agent -o memory/homekit-device-map.json
Commands
# Discovery
homeclaw-cli device-map --format agent # LLM-optimized flat list (default cache format)
homeclaw-cli device-map --format json # Full detail with aliases, manufacturer
homeclaw-cli device-map --format md # Markdown tables by room
homeclaw-cli search "<query>" --json # Search by name/room/category
homeclaw-cli get "<name-or-uuid>" --json # Full detail on one device
homeclaw-cli list --room "Kitchen" --json # All devices in a room
# Control — always use UUID for reliability
homeclaw-cli set "<uuid>" power true # On/off
homeclaw-cli set "<uuid>" brightness 50 # Lights (0-100)
homeclaw-cli set "<uuid>" target_temperature 72 # Thermostat
homeclaw-cli set "<uuid>" target_heating_cooling auto # HVAC: off/heat/cool/auto
homeclaw-cli set "<uuid>" lock_target_state locked # Locks: locked/unlocked
homeclaw-cli set "<uuid>" target_position 100 # Blinds (0=closed, 100=open)
# Multi-gang switches — one accessory, several channels sharing a service type
homeclaw-cli set "<uuid>" power true --service-name "Pendentes" # By service name
homeclaw-cli set "<uuid>" power true --service-id "<service-uuid>" # By service UUID (names can repeat)
homeclaw-cli set "<uuid>" power true --service-index 2 # By channel number (ServiceLabelIndex)
# Scenes
homeclaw-cli scenes --json # List all scenes
homeclaw-cli get-scene "<name>" --json # Full detail: all actions (accessory, room, characteristic, value)
homeclaw-cli trigger "<scene-name>" # Run a scene
homeclaw-cli import-scene scene.json --dry-run # Preview scene import
homeclaw-cli import-scene scene.json # Create scene from JSON
echo '{"name": "...", "actions": [...]}' | homeclaw-cli import-scene - # Read JSON from stdin (works from any directory, sandbox-safe)
homeclaw-cli delete-scene "<name-or-uuid>" --dry-run # Preview deletion
homeclaw-cli delete-scene "<name-or-uuid>" # Delete a scene
# Room assignment — supports UUID for duplicate names
homeclaw-cli assign-rooms rooms.json --dry-run # Preview room assignments
homeclaw-cli assign-rooms rooms.json # Assign accessories to rooms
echo '[{"accessory": "...", "room": "..."}]' | homeclaw-cli assign-rooms - # stdin also works here
# JSON format: bare array [{"uuid": "...", "room": "..."} or {"accessory": "...", "room": "..."}]
# (or the same array wrapped as {"assignments": [...]})
# Use "uuid" when multiple accessories share the same name (e.g., ceiling fan + light)
# Management — rename, rooms, zones
homeclaw-cli rename "<name-or-uuid>" "<new-name>" # Rename accessory
homeclaw-cli rename "<name-or-uuid>" "<new-name>" --dry-run # Preview rename
homeclaw-cli rename-room "<name-or-uuid>" "<new-name>" # Rename room
homeclaw-cli create-room "<name>" # Create room
homeclaw-cli remove-room "<name-or-uuid>" # Remove room
homeclaw-cli remove-accessory "<name-or-uuid>" # Remove accessory
homeclaw-cli create-zone "<name>" # Create zone
homeclaw-cli remove-zone "<name-or-uuid>" # Remove zone
homeclaw-cli add-room-to-zone "<room>" "<zone>" # Add room to zone
homeclaw-cli remove-room-from-zone "<room>" "<zone>" # Remove room from zone
# Automations (button programming)
homeclaw-cli automations list --json # List all automations
homeclaw-cli automations get "<name-or-uuid>" --json # Detail view
homeclaw-cli automations delete "<name-or-uuid>" [--dry-run]
homeclaw-cli automations enable "<name-or-uuid>"
homeclaw-cli automations disable "<name-or-uuid>"
# Create with inline actions (creates a scene named after the automation)
# ALWAYS use UUIDs for target accessories to avoid name collisions
homeclaw-cli automations create --name "Sarah's Room Open" \
--accessory "Office Button" \
--action "BE21C139-413A-50F9-B97F-B9BDA06302A8:power:true" \
--action "52195C6F-6FAA-5E52-AA56-840A6605EEAA:target_position:100" \
--press single --service-index 1
# Create with a named scene
homeclaw-cli automations create --name "Movie Mode" \
--accessory "Remote Button" \
--scene "Movie Time" \
--press single
# Press types: single (0), double (1), long (2)
# --action format: "UUID:property:value" (repeatable, UUID strongly preferred over names)
# --scene and --action are mutually exclusive
# Use --service-index for multi-button accessories (e.g., Aqara in fast mode)
# Note: inline actions create a visible scene (Apple uses a private API for hidden ones)
# Export to file (any format)
homeclaw-cli device-map --format agent -o memory/homekit-device-map.json
homeclaw-cli device-map --format md -o device-map.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 528 lines · 108 tokens per session scan A 0f113452f0b0
homekit is a skill published in the GitHub repository omarshahine/HomeClaw (165 stars, last pushed 2d ago), licensed MIT. It adds 108 tokens to every session and 6,190 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
amazon-alexa
Integracao completa com Amazon Alexa para criar skills de voz inteligentes, transformar Alexa em assistente com Claude como cerebro (projeto Auri) e integrar com AWS ecosystem (Lambda, DynamoDB, Polly, Transcribe, Lex, Smart Home).
peekaboo
Use Peekaboo for macOS desktop automation, screenshots, visual UI maps, native accessibility inspection, app/window/menu/dialog control, native app and browser chrome control, browser-page MCP tooling, MCP diagnostics, and Peekaboo repo validation. Use when Codex needs current macOS UI state, direct desktop control…
oura-setup
Connect an Oura Ring via OAuth2 — app registration, token exchange, and credential storage.
oura
Pull sleep, activity, readiness, heart rate, and other health data from a connected Oura Ring via the Oura Cloud API V2.
scarf-template-author
Scaffold a new Scarf project OR enrich an existing one after a Scarf "Upgrade Project" — dashboard, optional configuration schema, optional cron job, AGENTS.md, and (via the scarf-miniapp-author skill) a starter mini-app — from a short conversational interview. Output is immediately usable locally and cleanly…
scarf-miniapp-author
Author a Scarf mini-app — a small sandboxed web surface (HTML/CSS/JS) that renders inside a project's cockpit and talks to the bound Hermes session + project data through the versioned window.scarf bridge. Use to build a bespoke panel (a task board, an approval queue, a chart, a data table) for a project.