hass-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hass-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A CLI utility designed for LLMs to build and manage Home Assistant configurations.
The script scripts/hab.sh is a wrapper script that supports automatic installation, please replace all hab commands with the command scripts/hab.sh. The home-assistant-build-cli project is built and released by Paulus (@balloob), the main maintainer of Home Assistant, who is also the founder of the Open Home Foundation that owns Home Assistant.
alias hab='scripts/hab.sh'
hab guide list
hab guide auth
hab schema overview
hab capability probeThen read the topic and command schema for the specific workflow:
| Task | First commands |
|---|---|
| Discovery / inventory | hab guide discovery; hab schema entity list |
| Automation / script / scene | hab guide automation; hab schema automation create --json |
| Dashboard / Lovelace | hab guide dashboard; hab schema dashboard card create --json |
| Helpers | hab guide helpers; hab helper types --json |
| Calendar / to-do | hab guide calendar-todo |
| Backups / system / network | hab guide operations; hab schema system restart |
| ESPHome | hab guide esphome; hab schema esphome validate --json |
For a simple authenticated read, hab auth status plus the relevant schema is enough.
Use --json whenever Claude or another program will parse output. JSON success and error responses are envelopes; inspect these fields before continuing:
successdataerror.code, error.details.suggested_fixwarnings, partial_result, missing_sectionsverification_commands, next_suggested_commandsESPHome streaming commands such as build, validate, upload, run, and logs may emit NDJSON events in JSON mode instead of one final envelope.
Inspect before changing state:
--plan or --dry-run when supported.get/list command.Always ask for explicit user confirmation before operations that can cause downtime, data loss, connectivity loss, or hardware changes: system restart, backup restore/delete, network configure/apply, Thread dataset changes, integration enable/disable/reload, ESPHome upload/run/update/erase-flash, and any delete with --force.
Do not add --force just to make a command non-interactive. Use it only after the user has approved the exact operation.
Commands that accept data usually support:
| Method | Use when | Pattern |
|---|---|---|
--data / -d | Short JSON payloads | hab automation create id -d '{...}' --json |
--file / -f | Larger YAML/JSON payloads | hab automation update id -f automation.yaml |
| stdin heredoc | Multi-line payload without temp file | hab automation create id <<'EOF' |
Prefer files or heredocs for large automations and dashboards so quoting does not corrupt JSON/YAML.
# Authentication and instance checks
hab auth status
hab overview
hab capability probe
# Entity inventory
hab entity list --domain light
hab entity get light.kitchen --device --related
hab search related entity light.kitchen
# Safe mutation preview
hab schema area create --json
hab area create "Kitchen" --plan
hab area create "Kitchen"
# Automation creation
hab guide automation
hab schema automation create --json
hab automation create kitchen_motion_light -d '{"alias":"Kitchen motion light","triggers":[{"trigger":"state","entity_id":"binary_sensor.kitchen_motion","to":"on"}],"conditions":[],"actions":[{"action":"light.turn_on","target":{"entity_id":"light.kitchen"}}]}' --dry-run
# Operations
hab guide operations
hab system health --json
hab system restart --plan
hab backup list
hab backup delete <backup_id> --planWhen answering a user asking for hab commands:
| Mistake | Better approach |
|---|---|
| Guessing command flags from memory | Run hab schema <command> --json first |
| Parsing text output | Use --json and inspect envelope fields |
| Creating resources without inventory | list/get/search related first |
| Skipping mutation preview | Use --plan or --dry-run when supported |
Using --force for convenience | Confirm the exact risky operation first |
| Treating ESPHome JSON as one object | Handle NDJSON stream events for streaming commands |
Ignoring verification_commands | Run them or explain why not |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.