hass-builder

SUSPICIOUS. The skill’s purpose and capabilities are largely aligned with Home Assistant administration, and its safety guidance is unusually strong. However, the mandatory use of an unprovided auto-install wrapper script introduces material install-trust and credential-forwarding uncertainty that cannot be verified from this artifact alone. Absent the wrapper contents, this is not malicious, but it is riskier than a normal documentation skill.

The script is a conventional binary installer and launcher, not direct malware based on the supplied code. Its significant security risk is executing an unsigned binary obtained from the mutable GitHub latest-release endpoint and caching it without integrity verification. Use of a pinned release plus a verified checksum or signature would materially reduce the supply-chain risk.