nest-devices
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the user to download the cloudflared binary from Cloudflare's official GitHub repository to establish a secure ingress for webhooks.
- [COMMAND_EXECUTION]: Setup instructions include using sudo systemctl to create and manage background services for real-time event monitoring and chmod +x to prepare the downloaded tunnel binary.
- [CREDENTIALS_UNSAFE]: The skill requires the manual configuration and storage of sensitive credentials, including Google Cloud OAuth 2.0 client secrets, refresh tokens, and Telegram bot tokens.
- [PROMPT_INJECTION]: The skill processes external event data from Google Pub/Sub (e.g., doorbell rings and motion detection) which constitutes an indirect prompt injection surface. The ingestion point is the nest-webhook.py script which handles HTTP POST requests from the configured Cloudflare tunnel, with capabilities including device control and notification delivery.
Audit Metadata