Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add omarshahine/HomeClaw --skill homekitgit clone --depth 1 https://github.com/omarshahine/HomeClawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/omarshahine/homeclaw/homekit)<a href="https://agentmods.dev/skills/omarshahine/homeclaw/homekit"><img src="https://agentmods.dev/badge/skills/omarshahine/homeclaw/homekit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/omarshahine/homeclaw/homekit"><img src="https://agentmods.dev/badge/skills/omarshahine/homeclaw/homekit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 343 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 344 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Tool Misuse · line 184 Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.Fix: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00108 | $0.07878 |
| Opus 5.5 | $0.00043 | $0.03151 |
| Sonnet 5.5 | $0.00022 | $0.01576 |
| Haiku 4.5 | $0.00011 | $0.00788 |
Grade A, and why
homekit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 607 lines — stays where its author put it; the contents beside it link to each section on GitHub.
HomeKit Control
Golden Rule: Device Map First
Before your first HomeKit action in a session, read memory/homekit-device-map.json.
This compact device map has every device as a flat list with display_name, id (UUID), room, type (semantic category), controls (writable characteristics), and state. It's optimized for fast LLM scanning and disambiguation.
Refresh the cache periodically or when devices may have changed:
homeclaw-cli device-map --format agent -o memory/homekit-device-map.json
Resolving What the User Means
- Match user's words against
display_nameandroomfrom the cached map - Use
typeto disambiguate —lightingdevices support brightness;powerdevices are on/off only. A "Closet Light" withtype: powercannot dim. - If ambiguous, prefer the device in the most likely room (main living areas > bedrooms > outdoor)
- If still ambiguous, ask
- Always use UUIDs for write operations — many devices share names (9 "Overhead" lights, multiple "Blinds"). Use
display_namefor reading,id(UUID) forset,import-scene, andautomations createcommands - Check
controlsbefore sending a command — ifbrightnessisn't incontrols, don't try to set it - If no match found, refresh the cache first — devices may have been added/renamed:
Then retry the match. Only tell the user "device not found" if it's still missing after refresh.homeclaw-cli device-map --format agent -o memory/homekit-device-map.json
Commands
# Discovery
homeclaw-cli device-map --format agent # LLM-optimized flat list (default cache format)
homeclaw-cli device-map --format json # Full detail with aliases, manufacturer
homeclaw-cli device-map --format md # Markdown tables by room
homeclaw-cli device-map --home "<home>" --format agent # Scope map to one home
homeclaw-cli search "<query>" --json # Search by name/room/category
homeclaw-cli search "<query>" --home "<home>" --json
homeclaw-cli get "<name-or-uuid>" --json # Full detail on one device
homeclaw-cli get "<name-or-uuid>" --home "<home>" --json
homeclaw-cli list --room "Kitchen" --json # All devices in a room
homeclaw-cli list --home "<home>" --room "Kitchen" --json
# Control — always use UUID for reliability
homeclaw-cli set "<uuid>" power true # On/off
homeclaw-cli set "<uuid>" power true --home "<home>" # Multi-home: pin the home
homeclaw-cli set "<uuid>" brightness 50 # Lights (0-100)
homeclaw-cli set "<uuid>" target_temperature 72 # Thermostat
homeclaw-cli set "<uuid>" target_heating_cooling auto # HVAC: off/heat/cool/auto
homeclaw-cli set "<uuid>" lock_target_state locked # Locks: locked/unlocked
homeclaw-cli set "<uuid>" target_position 100 # Blinds (0=closed, 100=open)
# Multi-gang switches — one accessory, several channels sharing a service type
homeclaw-cli set "<uuid>" power true --service-name "Pendentes" # By service name
homeclaw-cli set "<uuid>" power true --service-id "<service-uuid>" # By service UUID (names can repeat)
homeclaw-cli set "<uuid>" power true --service-index 2 # By channel number (ServiceLabelIndex)
# Scenes
homeclaw-cli scenes --json # List all scenes
homeclaw-cli scenes --home "<home>" --json
homeclaw-cli get-scene "<name>" --json # Full detail: all actions (accessory, room, characteristic, value)
homeclaw-cli trigger "<scene-name>" # Run a scene
homeclaw-cli trigger "<scene-name>" --home "<home>"
homeclaw-cli import-scene scene.json --dry-run # Preview scene import
homeclaw-cli import-scene scene.json # Create scene from JSON
echo '{"name": "...", "actions": [...]}' | homeclaw-cli import-scene - # Read JSON from stdin (works from any directory, sandbox-safe)
homeclaw-cli delete-scene "<name-or-uuid>" --dry-run # Preview deletion
homeclaw-cli delete-scene "<name-or-uuid>" # Delete a scene
# Room assignment — supports UUID for duplicate names
homeclaw-cli assign-rooms rooms.json --dry-run # Preview room assignments
homeclaw-cli assign-rooms rooms.json # Assign accessories to rooms
echo '[{"accessory": "...", "room": "..."}]' | homeclaw-cli assign-rooms - # stdin also works here
# JSON format: bare array [{"uuid": "...", "room": "..."} or {"accessory": "...", "room": "..."}]
# (or the same array wrapped as {"assignments": [...]})
# Use "uuid" when multiple accessories share the same name (e.g., ceiling fan + light)
# Management — rename, rooms, zones
homeclaw-cli rename "<name-or-uuid>" "<new-name>" # Rename accessory
homeclaw-cli rename "<name-or-uuid>" "<new-name>" --dry-run # Preview rename
homeclaw-cli rename "<name-or-uuid>" "<new-name>" --service-name "Switch 2" # Rename one gang of a multi-gang accessory (also --service-index / --service-id, or pass the service UUID)
homeclaw-cli set-display-as "<name-or-uuid>" light|fan|switch|outlet|default [--service-index N] # Home app Display As (switch/outlet services only)
homeclaw-cli groups # Home app accessory groups (one tile each) and members
homeclaw-cli groups create "<group>" "<member>"... [--allow-mixed] # Members: accessory name/UUID or service UUID; one kind unless --allow-mixed
homeclaw-cli groups add|remove "<group>" "<member>"... # Change members
homeclaw-cli groups rename "<group>" "<new-name>" # Rename group
homeclaw-cli groups delete "<group>" # Delete group (accessories untouched)
homeclaw-cli rename-room "<name-or-uuid>" "<new-name>" # Rename room
homeclaw-cli create-room "<name>" # Create room
homeclaw-cli remove-room "<name-or-uuid>" # Remove room
homeclaw-cli remove-accessory "<name-or-uuid>" # Remove accessory
homeclaw-cli create-zone "<name>" # Create zone
homeclaw-cli remove-zone "<name-or-uuid>" # Remove zone
homeclaw-cli add-room-to-zone "<room>" "<zone>" # Add room to zone
homeclaw-cli remove-room-from-zone "<room>" "<zone>" # Remove room from zone
# Automations (button programming)
homeclaw-cli automations list --json # List all automations
homeclaw-cli automations get "<name-or-uuid>" --json # Detail view
homeclaw-cli automations delete "<name-or-uuid>" [--dry-run]
homeclaw-cli automations enable "<name-or-uuid>"
homeclaw-cli automations disable "<name-or-uuid>"
# Last run: every scene, and every entry in an automation's action_sets, carries
# last_execution_date (ISO-8601 UTC, or null). HomeKit leaves it null for most
# runs, including automations a home hub runs, so null means "none recorded",
# not "never ran". Use `events` for what actually happened.
# Create with inline actions (creates a scene named after the automation)
# ALWAYS use UUIDs for target accessories to avoid name collisions
homeclaw-cli automations create --name "Sarah's Room Open" \
--accessory "Office Button" \
--action "BE21C139-413A-50F9-B97F-B9BDA06302A8:power:true" \
--action "52195C6F-6FAA-5E52-AA56-840A6605EEAA:target_position:100" \
--press single --service-index 1
# Create with a named scene
homeclaw-cli automations create --name "Movie Mode" \
--accessory "Remote Button" \
--scene "Movie Time" \
--press single
# Press types: single (0), double (1), long (2)
# --action format: "UUID:property:value" (repeatable, UUID strongly preferred over names)
# --scene and --action are mutually exclusive
# Use --service-index for multi-button accessories (e.g., Aqara in fast mode); this picks the TRIGGER button
# Note: inline actions create a visible scene (Apple uses a private API for hidden ones)
# One gang of a multi-gang accessory as an action or condition target: JSON row form
# (repeatable; keys: accessory, property|characteristic, value, room, service_name, service_id, service_index)
homeclaw-cli automations create --name "Dining Unoccupied" \
--accessory "Dining FP2" --characteristic occupancy_detected --trigger-value false \
--action-json '{"accessory":"<uuid>","property":"power","value":"false","service_index":1}' \
--action-json '{"accessory":"<uuid>","property":"power","value":"false","service_index":2}' --dry-run
homeclaw-cli automations add-condition "<automation>" --accessory "<uuid>" --property power --value true --service-index 2
# Changing an existing automation: edit it in place (keeps the UUID, so button
# bindings and Siri references survive). Never delete + recreate to change it.
# Only the options passed change; preview with --dry-run and show the user first.
homeclaw-cli automations edit "<automation>" --time 06:45 --days mon,tue,wed,thu,fri --dry-run
homeclaw-cli automations edit "<automation>" --time-after sunset --time-before sunrise --duration 300
homeclaw-cli automations edit "<automation>" --condition-json '{"accessory":"<uuid>","property":"contact_state","value":"0"}'
homeclaw-cli automations edit "<automation>" --name "New name"
# --condition* replaces ALL characteristic conditions; --time-after/--time-before replace
# the whole time window; clear with --clear-conditions / --clear-time-window /
# --every-day / --clear-duration. --time replaces the trigger event(s) with a time of day.
# Timer automations from the Home app accept only --name.
# After a real run check "verified": false means the re-read differs ("mismatches").
# Replacing an accessory across automations (plan only; never writes without --apply)
homeclaw-cli automations migrate-actions --replace-accessory "<old-uuid>=<new-uuid>[,<new-uuid>]" --json
homeclaw-cli automations migrate-actions --replace-accessory "<old-uuid>=<new-uuid>" --automation "<uuid>" --json
# Each action set comes back with classification + status:
# visible_scene + supported -> can be written with --apply (ask the user first;
# shared_with lists other automations it also changes)
# visible_scene + blocked -> see issues (missing, ambiguous service, conflict)
# hidden + unsupported -> reason hidden_action_set_requires_private_spi.
# Apple only lets its own Home app edit automation-owned
# action sets. Do NOT work around it (no import-scene +
# rewire substitute). Render manual_steps as Home app
# instructions instead, then rerun the dry run to confirm.
# trigger_only: true -> the old accessory is this automation's trigger;
# nothing to migrate, but tell the user it will break
# Never claim a hidden set was migrated. See docs/PRIVATE_API.md for the boundary.
# Export to file (any format)
homeclaw-cli device-map --format agent -o memory/homekit-device-map.json
homeclaw-cli device-map --format md -o device-map.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · +13 lines fb6f13e0ba02
- 7d ago Changed · +47 lines 64b7a4c5d8f2
- 9d ago Changed · +5 lines 3122f2fa34f2
- 17d ago Changed · +7 lines 78f4d3621845
- 1mo ago Changed · +7 lines 8b0c40aec083
- 1mo ago First seen · 528 lines · 108 tokens per session scan A 0f113452f0b0
homekit is a skill published in the GitHub repository omarshahine/HomeClaw (185 stars, last pushed 3d ago), licensed MIT. It adds 108 tokens to every session and 7,878 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
amazon-alexa
Integracao completa com Amazon Alexa para criar skills de voz inteligentes, transformar Alexa em assistente com Claude como cerebro (projeto Auri) e integrar com AWS ecosystem (Lambda, DynamoDB, Polly, Transcribe, Lex, Smart Home).
peekaboo
Use Peekaboo for macOS screenshots, Accessibility inspection, and background app/window/UI automation, including fallback computer use when the primary tool cannot handle an authorized task.
oura-setup
Connect an Oura Ring via OAuth2 — app registration, token exchange, and credential storage.
scarf-template-author
Scaffold a new Scarf project OR enrich an existing one after a Scarf "Upgrade Project" — dashboard, optional configuration schema, optional cron job, AGENTS.md, and (via the scarf-miniapp-author skill) a starter mini-app — from a short conversational interview. Output is immediately usable locally and cleanly…
oura
Pull sleep, activity, readiness, heart rate, and other health data from a connected Oura Ring via the Oura Cloud API V2.
scarf-miniapp-author
Author a Scarf mini-app — a small sandboxed web surface (HTML/CSS/JS) that renders inside a project's cockpit and talks to the bound Hermes session + project data through the versioned window.scarf bridge. Use to build a bespoke panel (a task board, an approval queue, a chart, a data table) for a project.