The package is transparent about being a Home Assistant integration and the script behavior matches that description: it wraps REST API calls for device control and state queries.

Risk is elevated above SAFE because the package includes a shell script that runs curl directly on the user's machine and handles a long-lived bearer token, which creates a meaningful trust boundary even without malicious indicators.

The configured destination is user-controlled through HA_URL rather than hardcoded to an unrelated third-party endpoint, which reduces concern and argues against malicious intent.

No hooks, persistence mechanisms, scanner-evasion text, obfuscation, or hidden exfiltration paths were found. The caution rating is driven by credential plus network handling, not by evidence of abuse.