energykit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited energykit (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use grid cleanliness and cost guidance to shift or reduce managed-device load. For managed-device insights, submit the device's real load events promptly.
Beta-sensitive. Core EnergyKit ships in iOS/iPadOS 26. The iOS/iPadOS 27 ElectricalLoadDevice and Home-facing LoadEvents experience are beta; re-check current Apple documentation before relying on those APIs.| Runtime | Load-event device API | Capabilities |
|---|---|---|
| iOS/iPadOS 26.x | deviceID: compatibility initializer | EnergyKit |
| iOS/iPadOS 27+ beta | ElectricalLoadDevice with the device: initializer | EnergyKit; add EnergyKit LoadEvents for Home app integration |
All EnergyKit use requires com.apple.developer.energykit; enable the EnergyKit capability on the app target. On iOS/iPadOS 27+, add the EnergyKit LoadEvents capability (com.apple.developer.energykit.loadevents-experience) only when the app needs device names, energy context, activity logs, historical charts, or trend notifications in the Home app. That Home experience requires both capabilities. Missing permission can surface as EnergyKitError.permissionDenied.
import EnergyKitPlatform availability: Core EnergyKit APIs are iOS/iPadOS 26.0+. Some insight breakdown APIs, including grid cleanliness categories, are 26.1+ and need availability guards. Apple currently documents electricity guidance only for the contiguous United States; handle EnergyKitError.unsupportedRegion.
EnergyKit provides two main capabilities:
electricity is cleaner and, when rate data is available, less expensive
submitted by the same device/app that requested guidance so EnergyKit can generate insights
| Type | Role |
|---|---|
ElectricityGuidance | Forecast data with weighted time intervals |
ElectricityGuidance.Service | Interface for obtaining guidance data |
ElectricityGuidance.Query | Query specifying shift or reduce action |
ElectricityGuidance.Value | A time interval with a rating (0.0-1.0) |
EnergyVenue | A physical location (home) registered for energy management |
ElectricVehicleLoadEvent | Load event for EV charger telemetry |
ElectricHVACLoadEvent | Load event for HVAC system telemetry |
ElectricalLoadDevice | iOS/iPadOS 27+ beta device identity for load events |
ElectricityInsightService | Service for querying energy/runtime insights |
ElectricityInsightRecord | Historical energy or runtime data, optionally broken down by tariff or 26.1+ grid cleanliness |
ElectricityInsightQuery | Query for historical insight data |
| Action | Use Case |
|---|---|
.shift | Devices that can move consumption to a different time (EV charging) |
.reduce | Devices that can lower consumption without stopping (HVAC setback) |
Use ElectricityGuidance.Service to get a forecast stream for a venue.
import EnergyKit
func observeGuidance(venueID: UUID) async throws {
let query = ElectricityGuidance.Query(suggestedAction: .shift)
let service = ElectricityGuidance.sharedService
let guidanceStream = service.guidance(using: query, at: venueID)
for try await guidance in guidanceStream {
print("Guidance token: \(guidance.guidanceToken)")
print("Interval: \(guidance.interval)")
print("Venue: \(guidance.energyVenueID)")
// Check if rate plan information is available
if guidance.options.contains(.guidanceIncorporatesRatePlan) {
print("Rate plan data incorporated")
}
if guidance.options.contains(.locationHasRatePlan) {
print("Location has a rate plan")
}
processGuidanceValues(guidance.values)
}
}Each ElectricityGuidance.Value contains a time interval and a rating from 0.0 to 1.0. Lower ratings indicate better times to use electricity.
func processGuidanceValues(_ values: [ElectricityGuidance.Value]) {
for value in values {
let interval = value.interval
let rating = value.rating // 0.0 (best) to 1.0 (worst)
print("From \(interval.start) to \(interval.end): rating \(rating)")
}
}
// Find the best time to charge
func bestChargingWindow(
in values: [ElectricityGuidance.Value]
) -> ElectricityGuidance.Value? {
values.min(by: { $0.rating < $1.rating })
}
// Find all "good" windows below a threshold
func goodWindows(
in values: [ElectricityGuidance.Value],
threshold: Double = 0.3
) -> [ElectricityGuidance.Value] {
values.filter { $0.rating <= threshold }
}import SwiftUI
import EnergyKit
struct GuidanceTimelineView: View {
let values: [ElectricityGuidance.Value]
var body: some View {
List(values, id: \.interval.start) { value in
HStack {
VStack(alignment: .leading) {
Text(value.interval.start, style: .time)
Text(value.interval.end, style: .time)
.foregroundStyle(.secondary)
}
Spacer()
RatingIndicator(rating: value.rating)
}
}
}
}
struct RatingIndicator: View {
let rating: Double
var color: Color {
if rating <= 0.3 { return .green }
if rating <= 0.6 { return .yellow }
return .red
}
var label: String {
if rating <= 0.3 { return "Good" }
if rating <= 0.6 { return "Fair" }
return "Avoid"
}
var body: some View {
Text(label)
.padding(.horizontal)
.padding(.vertical)
.background(color.opacity(0.2))
.foregroundStyle(color)
.clipShape(Capsule())
}
}An EnergyVenue represents a physical location registered for energy management.
// List all venues
func listVenues() async throws -> [EnergyVenue] {
try await EnergyVenue.venues()
}
// Get a specific venue by ID
func getVenue(id: UUID) async throws -> EnergyVenue {
try await EnergyVenue.venue(for: id)
}
// Get a venue matching a HomeKit home
func getVenueForHome(homeID: UUID) async throws -> EnergyVenue {
try await EnergyVenue.venue(matchingHomeUniqueIdentifier: homeID)
}let venue = try await EnergyVenue.venue(for: venueID)
print("Venue ID: \(venue.id)")
print("Venue name: \(venue.name)")Report device consumption data back to the system. This helps the system generate electricity insights. The same EnergyKit-capable device/app that requested electricity guidance must submit the corresponding load events, using the guidance token returned by EnergyKit. Do not invent a token.
func submitEVBeginEvent(
at venue: EnergyVenue,
guidanceToken: UUID,
deviceID: String,
deviceName: String
) async throws {
let session = ElectricVehicleLoadEvent.Session(
id: UUID(),
state: .begin,
guidanceState: ElectricVehicleLoadEvent.Session.GuidanceState(
wasFollowingGuidance: true,
guidanceToken: guidanceToken
)
)
let measurement = ElectricVehicleLoadEvent.ElectricalMeasurement(
stateOfCharge: 45,
direction: .imported,
power: Measurement(value: 0, unit: .kilowatts),
energy: Measurement(value: 0, unit: .kilowattHours)
)
let event: ElectricVehicleLoadEvent
if #available(iOS 27.0, iPadOS 27.0, *) {
let device = ElectricalLoadDevice(
id: deviceID,
name: deviceName,
type: .electricVehicle
)
event = ElectricVehicleLoadEvent(
timestamp: Date(), measurement: measurement,
session: session, device: device
)
} else {
// iOS/iPadOS 26 compatibility; deprecated in the iOS 27 SDK.
event = ElectricVehicleLoadEvent(
timestamp: Date(), measurement: measurement,
session: session, deviceID: deviceID
)
}
try await venue.submitEvents([event])
}func submitHVACEvent(
at venue: EnergyVenue,
guidanceToken: UUID,
stage: Int,
deviceID: String,
deviceName: String
) async throws {
let session = ElectricHVACLoadEvent.Session(
id: UUID(),
state: .active,
guidanceState: ElectricHVACLoadEvent.Session.GuidanceState(
wasFollowingGuidance: true,
guidanceToken: guidanceToken
)
)
let measurement = ElectricHVACLoadEvent.ElectricalMeasurement(stage: stage)
let event: ElectricHVACLoadEvent
if #available(iOS 27.0, iPadOS 27.0, *) {
let device = ElectricalLoadDevice(
id: deviceID,
name: deviceName,
type: .hvac
)
event = ElectricHVACLoadEvent(
timestamp: Date(), measurement: measurement,
session: session, device: device
)
} else {
// iOS/iPadOS 26 compatibility; deprecated in the iOS 27 SDK.
event = ElectricHVACLoadEvent(
timestamp: Date(), measurement: measurement,
session: session, deviceID: deviceID
)
}
try await venue.submitEvents([event])
}| State | When to Use |
|---|---|
.begin | Device starts consuming electricity |
.active | Device is actively consuming (periodic updates) |
.end | Device stops consuming electricity |
Preserve .begin → .active → .end and submit events promptly rather than holding long batches. For EV charging, submit .begin with zero power and energy, .active about every 15 minutes plus significant changes, and .end with zero power and cumulative energy. Retain unacknowledged events and retry EnergyKitError.rateLimitExceeded with bounded backoff. Load the EV session manager or HVAC session manager for device-specific lifecycle handling.
Only promise Home app device names, energy context, activity logs, charts, and trend notifications on iOS/iPadOS 27+ when both the base EnergyKit and EnergyKit LoadEvents capabilities are present.
Query historical energy and runtime data for devices using ElectricityInsightService. An empty ElectricityInsightQuery.Options option set returns totals only; it does not populate cleanliness or tariff breakdowns. Request .cleanliness and/or .tariff only when the UI needs those breakdowns. Do not substitute MetricKit app power metrics for EnergyKit insights; EnergyKit insights depend on EnergyKit load events submitted for the managed device.
Choose insight granularity from the requested range. For a seven-day view, query .hourly; use .daily only when the query covers at least a calendar month.
func queryEnergyInsights(deviceID: String, venueID: UUID) async throws {
let sevenDaysAgo = Calendar.current.date(
byAdding: .day,
value: -7,
to: Date()
)!
let query = ElectricityInsightQuery(
options: [.cleanliness, .tariff],
range: DateInterval(
start: sevenDaysAgo,
end: Date()
),
granularity: .hourly,
flowDirection: .imported
)
let service = ElectricityInsightService.shared
let stream = try await service.energyInsights(
forDeviceID: deviceID, using: query, atVenue: venueID
)
for await record in stream {
if let total = record.totalEnergy { print("Total: \(total)") }
if #available(iOS 26.1, iPadOS 26.1, *),
let cleaner = record.dataByGridCleanliness?.cleaner {
print("Cleaner: \(cleaner)")
}
}
}Use runtimeInsights(forDeviceID:using:atVenue:) for runtime data instead of energy. Granularity options: .hourly, .daily, .weekly, .monthly, .yearly. Choose a range that matches Apple's minimum aggregation windows: hourly for at least a calendar week, daily for at least a calendar month, weekly for at least six months, and monthly or yearly for at least a calendar year. See references/energykit-patterns.md for full insight examples.
| Mistake | Fix |
|---|---|
| Querying before capability setup | Verify the EnergyKit entitlement and handle .permissionDenied. |
| Assuming every region has guidance | Apple currently documents guidance only in the contiguous US; handle unsupported-region and unavailable venue/guidance states. |
| Fabricating or discarding the guidance token | Persist the real token on the requesting device and submit that token with its load events. |
| Sending isolated or delayed load samples | Preserve .begin → .active → .end, submit promptly, and retain events until submission succeeds. |
Using deviceID: as the current default | Use iOS/iPadOS 27+ ElectricalLoadDevice and device:; keep deviceID: only for the 26.x runtime branch. |
| Using a hardcoded venue ID | Discover venues with EnergyVenue.venues() and select the intended venue. |
ElectricalLoadDevice/device:; deviceID: is isolated to 26.x compatibility.begin → .active → .end events follow device cadence, submit promptly, survive failure, and retry rate limits with bounded backoffpresentation, insights, errors, and venue discovery: references/energykit-patterns.md
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.