API Catalog — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited API Catalog (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reference skill for connecting external APIs and services to Home Assistant.
This skill covers authentication patterns and working code examples for connecting popular APIs to Home Assistant via three methods:
rest sensor and rest_command (good for simple polling)ha-integration skill)CREDENTIALS IN SECRETS - NEVER HARDCODED IN FLOWS OR YAMLAPI keys belong in Node-RED credentials, ESPHome secrets.yaml, or HA secrets.yaml. Never paste real tokens into chat, flows that get exported, or YAML committed to git.
| Category | File | APIs Covered |
|---|---|---|
| Energy & electricity | references/energy-apis.md | Tibber, Nordpool, Energi Data Service |
| Weather | references/weather-apis.md | SMHI, OpenWeatherMap, yr.no, Tomorrow.io |
| Transport | references/transport-apis.md | SL, Trafikverket, Resrobot, Entur (NO) |
| Smart home clouds | references/smarthome-apis.md | Shelly Cloud, Tuya IoT, Philips Hue, IKEA Dirigera |
| Global / other | references/global-apis.md | OpenAI, Spotify, Google Calendar, Telegram, GitHub |
| Pattern | How it works | Examples |
|---|---|---|
| API key in header | Authorization: Bearer {key} or X-API-Key: {key} | Tibber, OpenAI |
| API key in URL | ?appid={key} appended to URL | OpenWeatherMap |
| OAuth2 | Get access token first, refresh periodically | Spotify, Google |
| Local token | One-time press-button auth on device | Philips Hue |
| No auth | Public API, no credentials needed | SMHI, yr.no, Nordpool |
| Basic auth | Username + password Base64-encoded | Some local devices |
For each API, generate code for the method the user needs:
Node-RED: http request node + function node to parse + api-call-service to push to HA HA YAML: rest sensor platform or rest_command under configuration.yaml Full integration: Use ha-integration skill with the polling-integration template
{
"type": "http request",
"method": "GET",
"url": "https://api.example.com/data",
"headers": {"Authorization": "Bearer {{env.API_KEY}}"},
"ret": "obj"
}{
"type": "http request",
"method": "POST",
"url": "https://api.tibber.com/v1-beta/gql",
"headers": {
"Authorization": "Bearer {{env.TIBBER_TOKEN}}",
"Content-Type": "application/json"
},
"payload": "{\"query\": \"{ viewer { homes { currentSubscription { priceInfo { current { total } } } } } }\"}",
"ret": "obj"
}rest:
- scan_interval: 300
resource: https://api.example.com/current
headers:
Authorization: !secret example_api_key
sensor:
- name: "Example Value"
value_template: "{{ value_json.data.value }}"
unit_of_measurement: "°C"!secret (YAML), Node-RED credentials, or env vars - never hardcodedscan_interval or flow timer accordingly)Pairs with:
node-red skill - for flow JSON implementationha-yaml skill - for YAML sensor and automation using the fetched dataha-integration skill - for building a full HACS-publishable Python integration~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.