Community code plugin. Review compatibility and verification before install.
Latest release: v0.1.8Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The package purpose is coherent: it registers tools for Lutron Caseta lighting, scenes, shades, fans, Smart Away, occupancy, battery checks, and bridge export through the lutron CLI.
Instruction Scope
The skill explicitly documents broad state-changing workflows such as lutron_all_off for the whole house, scene activation, cover control, and Pico/keypad tap simulation, but does not instruct the agent to require confirmation for disruptive actions.
Install Mechanism
Installation is disclosed as an OpenClaw npm-pack plugin requiring the external lutron binary, with configuration for cliPath and bridgeHost; no install hooks or hidden setup scripts were found.
Credentials
Shelling out to lutron via execFile with argv arrays is proportionate for this integration, and static scan plus VirusTotal telemetry were clean, but the plugin depends on a paired local bridge that can affect the physical home.
Persistence & Privilege
The plugin itself does not add persistence, but it relies on lutron-cli pairing credentials/config and exposes lutron_export, which can reveal rooms, devices, scenes, occupancy groups, and buttons without a privacy warning.
Scan Findings in Context
[SQP-2] expected: The physical control tools are expected for a Lutron controller, but the lack of built-in confirmation or policy gating for whole-home and disruptive actions is a real user-control concern.
[SQP-2] expected: The documented whole-house lutron_all_off workflow matches the plugin purpose, but the wording and examples show it can be invoked broadly without an explicit confirmation step.
[SQP-2] expected: The export capability is useful for backup or diffing, but it can expose sensitive home layout and automation metadata and is under-disclosed from a privacy perspective.
What to consider before installing
Install only if you are comfortable giving an agent direct control over your Lutron bridge. Require explicit confirmation before whole-home actions like all-off, scene activation, shade movement, Smart Away changes, or Pico button taps, and treat exported bridge snapshots as sensitive home-layout data.