homekit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited homekit (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Control home automation accessories and commission Matter devices. HomeKit manages the home/room/accessory model, action sets, and triggers. MatterSupport handles device commissioning into your ecosystem.
NSHomeKitUsageDescription to Info.plist:<key>NSHomeKitUsageDescription</key>
<string>This app controls your smart home accessories.</string>For Matter commissioning into your own ecosystem:
MatterAddDeviceExtensionRequestHandler subclass
NSBonjourServices entries for _matter._tcp, _matterc._udp, and_matterd._udp
com.apple.developer.matter.allow-setup-payload only if the callersupplies a Matter setup payload programmatically
| Need | Framework |
|---|---|
| Homes, rooms, accessories, characteristics, actions, triggers | HomeKit |
| Commission Matter into the app ecosystem | MatterSupport |
| Select and authorize a nearby Bluetooth or Wi-Fi accessory | AccessorySetupKit |
| Exchange Bluetooth GATT data after selection | CoreBluetooth |
| Join or configure an accessory's Wi-Fi network after selection | NetworkExtension |
HomeKit organizes home automation in a hierarchy:
HMHomeManager
-> HMHome (one or more)
-> HMRoom (rooms in the home)
-> HMAccessory (devices in a room)
-> HMService (functions: light, thermostat, etc.)
-> HMCharacteristic (readable/writable values)
-> HMZone (groups of rooms)
-> HMActionSet (grouped actions)
-> HMTrigger (time or event-based triggers)Create a single HMHomeManager and implement the delegate to know when data is loaded. HomeKit loads asynchronously -- do not access homes until the delegate fires.
import HomeKit
final class HomeStore: NSObject, HMHomeManagerDelegate {
let homeManager = HMHomeManager()
override init() {
super.init()
homeManager.delegate = self
}
func homeManagerDidUpdateHomes(_ manager: HMHomeManager) {
// Safe to access manager.homes now
let homes = manager.homes
let primaryHome = manager.primaryHome
print("Loaded \(homes.count) homes")
}
func homeManager(
_ manager: HMHomeManager,
didUpdate status: HMHomeManagerAuthorizationStatus
) {
if status.contains(.authorized) {
print("HomeKit access granted")
}
}
}guard let home = homeManager.primaryHome else { return }
let rooms = home.rooms
let kitchen = rooms.first { $0.name == "Kitchen" }
// Room for accessories not assigned to a specific room
let defaultRoom = home.roomForEntireHome()Use the Framework Boundary table before adding an accessory; only HomeKit/MatterSupport work continues in this skill.
// System UI for accessory discovery
home.addAndSetupAccessories { error in
if let error {
print("Setup failed: \(error)")
}
}for accessory in home.accessories {
print("\(accessory.name) in \(accessory.room?.name ?? "unassigned")")
for service in accessory.services {
print(" Service: \(service.serviceType)")
for characteristic in service.characteristics {
print(" \(characteristic.characteristicType): \(characteristic.value ?? "nil")")
}
}
}guard let accessory = home.accessories.first,
let bedroom = home.rooms.first(where: { $0.name == "Bedroom" }) else { return }
home.assignAccessory(accessory, to: bedroom) { error in
if let error {
print("Failed to move accessory: \(error)")
}
}let characteristic: HMCharacteristic = // obtained from a service
characteristic.readValue { error in
guard error == nil else { return }
if let value = characteristic.value as? Bool {
print("Power state: \(value)")
}
}// Turn on a light
characteristic.writeValue(true) { error in
if let error {
print("Write failed: \(error)")
}
}Enable notifications for real-time updates:
characteristic.enableNotification(true) { error in
guard error == nil else { return }
}
// In HMAccessoryDelegate:
func accessory(
_ accessory: HMAccessory,
service: HMService,
didUpdateValueFor characteristic: HMCharacteristic
) {
print("Updated: \(characteristic.value ?? "nil")")
}An HMActionSet groups characteristic writes that execute together:
home.addActionSet(withName: "Good Night") { actionSet, error in
guard let actionSet, error == nil else { return }
// Turn off living room light
let lightChar = livingRoomLight.powerCharacteristic
let action = HMCharacteristicWriteAction(
characteristic: lightChar,
targetValue: false as NSCopying
)
actionSet.addAction(action) { error in
guard error == nil else { return }
print("Action added to Good Night scene")
}
}home.executeActionSet(actionSet) { error in
if let error {
print("Execution failed: \(error)")
}
}var timeOfDay = DateComponents()
timeOfDay.hour = 22
timeOfDay.minute = 30
let firstFireDate = Calendar.current.nextDate(
after: Date(),
matching: timeOfDay,
matchingPolicy: .nextTime
)!
let trigger = HMTimerTrigger(
name: "Nightly",
fireDate: firstFireDate,
recurrence: DateComponents(day: 1) // Repeat every day after firstFireDate
)
home.addTrigger(trigger) { error in
guard error == nil else { return }
// Attach the action set to the trigger
trigger.addActionSet(goodNightActionSet) { error in
guard error == nil else { return }
trigger.enable(true) { error in
print("Trigger enabled: \(error == nil)")
}
}
}let motionDetected = HMCharacteristicEvent(
characteristic: motionSensorCharacteristic,
triggerValue: true as NSCopying
)
let eventTrigger = HMEventTrigger(
name: "Motion Lights",
events: [motionDetected],
predicate: nil
)
home.addTrigger(eventTrigger) { error in
// Add action sets as above
}Use MatterAddDeviceRequest to commission a Matter device into your ecosystem. This is separate from the HMHome home-automation model; it handles the Matter setup flow and calls into your MatterSupport extension.
import MatterSupport
func addMatterDevice() async throws {
guard MatterAddDeviceRequest.isSupported else {
print("Matter not supported on this device")
return
}
let topology = MatterAddDeviceRequest.Topology(
ecosystemName: "My Smart Home",
homes: [
MatterAddDeviceRequest.Home(displayName: "Main House")
]
)
let request = MatterAddDeviceRequest(
topology: topology,
setupPayload: nil,
showing: .allDevices
)
// Presents system UI for device pairing
try await request.perform()
}When providing a setup code directly, import Matter and pass an MTRSetupPayload as setupPayload; this is the case that requires the setup-payload entitlement.
// Only show devices from a specific vendor
let criteria = MatterAddDeviceRequest.DeviceCriteria.vendorID(0x1234)
let request = MatterAddDeviceRequest(
topology: topology,
setupPayload: nil,
showing: criteria
)Combine criteria with .all([.vendorID(...), .not(.productID(...))]) or use .any(...) when any one criterion is enough.
For full ecosystem support, create a MatterSupport Extension. The extension handles commissioning callbacks. Override the needed methods, but do not call super from those overrides. Load the complete Advanced Matter Extension Handler for credential validation, room selection, configuration, commissioning, and network-association overrides.
| Mistake | Fix |
|---|---|
| Reading homes before the delegate update | Create one manager, set its delegate, and wait for homeManagerDidUpdateHomes. |
| HomeKit setup is used for Matter ecosystem commissioning | Use MatterAddDeviceRequest plus the configured MatterSupport extension. |
| Matter configuration is incomplete | Verify principal handler, Bonjour services, and the setup-payload entitlement only when applicable. |
Multiple HMHomeManager instances load the database | Share one retained manager/store. |
| Characteristic write ignores metadata | Check permissions, format, min/max/step, and allowed values before writing. |
NSHomeKitUsageDescription present in Info.plistHMHomeManager instance shared across the appHMHomeManagerDelegate implemented; homes not accessed before homeManagerDidUpdateHomesHMHomeDelegate set on homes to receive accessory and room changesHMAccessoryDelegate set on accessories to receive characteristic updatesNSBonjourServices entries addedcom.apple.developer.matter.allow-setup-payload used only when providing setup codesMatterAddDeviceRequest.isSupported checked before performing requestscommissionDevice(in:onboardingPayload:commissioningID:)trigger.enable(true))~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.