Install
$ agentstack add skill-markusleben-ha-nova-dashboard ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
HA NOVA Dashboard
Scope
Storage dashboard work only:
- list dashboards
- read one dashboard config
- list Lovelace resources
- inspect the current dashboard structure: views, cards, badges, header cards
- create a new storage dashboard shell
- update dashboard metadata
- create, update, and delete Lovelace resources
- find a specific dashboard element before changing it
- add, update, move, and delete cards inside existing views
- delete an existing storage dashboard
This skill is safety-first:
- always resolve the target from
lovelace/dashboards/list - only write/delete when the dashboard
modeisstorage - always read the full current dashboard before any content write
- always save the full merged config, never a guessed partial fragment
- always read back and verify the intended change
Not in scope:
- raw broad Lovelace editing without a concrete requested change
- view create/delete/reorder
- non-storage dashboard writes/deletes
- freeform new custom-card creation
- energy dashboard preferences
If the user asks for a broad redesign instead of a concrete safe change, narrow the request first. Do not guess.
Bootstrap (once per session)
Verify relay CLI: ha-nova relay health If this fails: ha-nova setup
Relay Contract
Use file-based WS requests only:
ha-nova relay ws --data-fileha-nova relay ws --data-file --outha-nova relay ws --data-file --jq-file
Relevant WS types:
lovelace/dashboards/listlovelace/dashboards/createlovelace/dashboards/updatelovelace/dashboards/deletelovelace/configlovelace/config/savelovelace/resourceslovelace/resources/createlovelace/resources/updatelovelace/resources/delete
Critical behavior:
lovelace/config/saveis a full-document overwrite- there is no partial update endpoint
- omitted views/cards are lost
lovelace/dashboards/listis the source of truth fordashboard_id,url_path, andmodelovelace/config/deleteis not the dashboard delete path for this skilllovelace/resourcesshows installed Lovelace resources, but that alone is not proof that a custom-card schema is safe to invent
Flow
- Resolve the dashboard target.
- Always list dashboards first with
lovelace/dashboards/list. - Match by
url_path, title, or current identity. - Keep both identifiers:
dashboard_idforlovelace/dashboards/update|deleteurl_pathforlovelace/config|save- Ask one blocking question only if more than one dashboard still matches.
- Check write/delete eligibility.
- use the matched dashboard
modefromlovelace/dashboards/list - only
mode=storageis writable/deletable here - if
modeis notstorage, stop and explain that this skill will not write or delete it
- Choose the mutation path.
- create shell: preview
title,url_path,icon,require_admin,show_in_sidebar, then calllovelace/dashboards/create - metadata update: preview the exact metadata fields, then call
lovelace/dashboards/updatewithdashboard_id - only send changed metadata fields supported there:
title,icon,show_in_sidebar,require_admin - do not resend
url_path,mode, or unrelated config fields in the update payload - resource inventory: use
lovelace/resources - resource create/update:
- preview
res_typeandurl - call
lovelace/resources/create|update - resource delete:
- preview the exact resource identity
- require exact token confirmation
confirm: - call
lovelace/resources/deletewithresource_id - content update / card operation:
- read the current dashboard config with
lovelace/config - build a compact inventory of views, cards, badges, and header cards
- resolve the exact target by view, title/heading text, entity reference, card type, or explicit position
- merge the requested change in memory
- preview a concise diff/excerpt
- save the full merged config with
lovelace/config/save - new cards may be created only from this built-in allowlist:
entity,entities,button,tile,gauge,sensor,markdown,history-graph- existing custom cards may only be moved, deleted, or shallow-updated when the exact field already exists
- delete:
- preview the exact dashboard identity
- require exact token confirmation
confirm: - call
lovelace/dashboards/deletewithdashboard_id
- Read the current dashboard when content changes are involved.
- use
lovelace/configwith the chosenurl_path
- Read back and verify:
- create / metadata update / delete: verify through
lovelace/dashboards/list - resource create/update/delete: verify through
lovelace/resources - content update: verify through
lovelace/config - content update must confirm both the intended field change and unrelated-view survival
- If verification fails, stop and report the mismatch. Do not retry by guessing.
Output Format
For list/read:
DashboardTargetSummary- relevant config or inventory excerpt only
For create/update/delete:
DashboardModePlanned changeVerificationNext step
Do not dump the full dashboard JSON/YAML by default.
Safety
- No guessed
url_pathordashboard_idvalues. - Create/update uses natural confirmation after preview.
- Dashboard/resource delete uses exact token confirmation only.
- If the requested change would require a broad re-layout instead of a targeted edit, say so before writing.
Guardrails
- Never call
lovelace/config/savewith a partial config. - Never use
lovelace/infoto decide whether a dashboard is writable. - Never use
lovelace/config/deleteas the dashboard delete path. - Never verify only by save success; always read back the dashboard.
- Never probe a different dashboard's config just to infer behavior for the target dashboard.
- Never invent a new custom-card schema just because a resource exists.
- If the dashboard target is still ambiguous after one clarification, stop and explain the remaining ambiguity.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: markusleben
- Source: markusleben/ha-nova
- License: MIT
- Homepage: https://github.com/markusleben/ha-nova
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.