Is openhue safe?
Yes. openhue is safe to install. Oathe's behavioral security audit gave openhue a trust score of 90/100 with 4 findings, none critical or high.
https://clawhub.ai/steipete/openhue
Is openhue safe to install?
The openhue skill is a minimal, clean markdown-only skill that provides CLI instructions for controlling Philips Hue lights. It contains no executable code, no prompt injection vectors, and no data exfiltration mechanisms. The only notable concerns are the third-party Homebrew tap dependency and the inherent physical-world side effects of smart home control. Runtime environment file reads during bootstrap are attributable to the OpenClaw platform, not the skill.
What security issues were found in openhue?
Category Scores
Findings (4)
LOW Third-party Homebrew tap dependency -10 ▶
The skill installs the openhue CLI from a third-party Homebrew tap (openhue/cli/openhue-cli). While this is standard practice for non-core Homebrew packages, it means the binary is maintained outside of Homebrew's core review process. Users should verify the tap source.
INFO Runtime environment reads sensitive file paths -15 ▶
The OpenClaw agent runtime (not the skill itself) reads .env, .aws/credentials, .openclaw config, .profile, and .bashrc during bootstrap. This is standard runtime behavior and not caused by the skill under test. The .aws/credentials file was opened but canary integrity was maintained.
LOW Physical-world side effects via smart home control -15 ▶
This skill enables an AI agent to control physical lights. While intended and useful, unintended activations could cause minor disruption (lights toggling unexpectedly). The blast radius is limited to the user's Hue Bridge network.
INFO Clean skill with no injection vectors -5 ▶
SKILL.md is a minimal, well-structured markdown document containing only CLI usage examples. No hidden instructions, no persona manipulation, no obfuscated content.
Should I install openhue?
Oathe's verdict for openhue is SAFE with a trust score of 90/100. Recommendation: Install.