AgentStack
Browse Sign in
Browse Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Dashboard

skill-markusleben-ha-nova-dashboard · by markusleben

Use when listing, reading, creating, updating, or deleting storage-backed Home Assistant dashboards, Lovelace resources, and targeted card changes through HA NOVA Relay.

No reviews yet
0 installs
22 views
0.0% view→install

Install

$ agentstack add skill-markusleben-ha-nova-dashboard

✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README, it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/skill-markusleben-ha-nova-dashboard)

Reliability & compatibility

Security review passed
0 installs to date
no reviews yet
1mo ago

Declared compatibility

Claude CodeClaude Desktop

Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Dashboard? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

HA NOVA Dashboard

Scope

Storage dashboard work only:

  • list dashboards
  • read one dashboard config
  • list Lovelace resources
  • inspect the current dashboard structure: views, cards, badges, header cards
  • create a new storage dashboard shell
  • update dashboard metadata
  • create, update, and delete Lovelace resources
  • find a specific dashboard element before changing it
  • add, update, move, and delete cards inside existing views
  • delete an existing storage dashboard

This skill is safety-first:

  • always resolve the target from lovelace/dashboards/list
  • only write/delete when the dashboard mode is storage
  • always read the full current dashboard before any content write
  • always save the full merged config, never a guessed partial fragment
  • always read back and verify the intended change

Not in scope:

  • raw broad Lovelace editing without a concrete requested change
  • view create/delete/reorder
  • non-storage dashboard writes/deletes
  • freeform new custom-card creation
  • energy dashboard preferences

If the user asks for a broad redesign instead of a concrete safe change, narrow the request first. Do not guess.

Bootstrap (once per session)

Verify relay CLI: ha-nova relay health If this fails: ha-nova setup

Relay Contract

Use file-based WS requests only:

  • ha-nova relay ws --data-file
  • ha-nova relay ws --data-file --out
  • ha-nova relay ws --data-file --jq-file

Relevant WS types:

  • lovelace/dashboards/list
  • lovelace/dashboards/create
  • lovelace/dashboards/update
  • lovelace/dashboards/delete
  • lovelace/config
  • lovelace/config/save
  • lovelace/resources
  • lovelace/resources/create
  • lovelace/resources/update
  • lovelace/resources/delete

Critical behavior:

  • lovelace/config/save is a full-document overwrite
  • there is no partial update endpoint
  • omitted views/cards are lost
  • lovelace/dashboards/list is the source of truth for dashboard_id, url_path, and mode
  • lovelace/config/delete is not the dashboard delete path for this skill
  • lovelace/resources shows installed Lovelace resources, but that alone is not proof that a custom-card schema is safe to invent

Flow

  1. Resolve the dashboard target.
  • Always list dashboards first with lovelace/dashboards/list.
  • Match by url_path, title, or current identity.
  • Keep both identifiers:
  • dashboard_id for lovelace/dashboards/update|delete
  • url_path for lovelace/config|save
  • Ask one blocking question only if more than one dashboard still matches.
  1. Check write/delete eligibility.
  • use the matched dashboard mode from lovelace/dashboards/list
  • only mode=storage is writable/deletable here
  • if mode is not storage, stop and explain that this skill will not write or delete it
  1. Choose the mutation path.
  • create shell: preview title, url_path, icon, require_admin, show_in_sidebar, then call lovelace/dashboards/create
  • metadata update: preview the exact metadata fields, then call lovelace/dashboards/update with dashboard_id
  • only send changed metadata fields supported there: title, icon, show_in_sidebar, require_admin
  • do not resend url_path, mode, or unrelated config fields in the update payload
  • resource inventory: use lovelace/resources
  • resource create/update:
  • preview res_type and url
  • call lovelace/resources/create|update
  • resource delete:
  • preview the exact resource identity
  • require exact token confirmation confirm:
  • call lovelace/resources/delete with resource_id
  • content update / card operation:
  • read the current dashboard config with lovelace/config
  • build a compact inventory of views, cards, badges, and header cards
  • resolve the exact target by view, title/heading text, entity reference, card type, or explicit position
  • merge the requested change in memory
  • preview a concise diff/excerpt
  • save the full merged config with lovelace/config/save
  • new cards may be created only from this built-in allowlist:
  • entity, entities, button, tile, gauge, sensor, markdown, history-graph
  • existing custom cards may only be moved, deleted, or shallow-updated when the exact field already exists
  • delete:
  • preview the exact dashboard identity
  • require exact token confirmation confirm:
  • call lovelace/dashboards/delete with dashboard_id
  1. Read the current dashboard when content changes are involved.
  • use lovelace/config with the chosen url_path
  1. Read back and verify:
  • create / metadata update / delete: verify through lovelace/dashboards/list
  • resource create/update/delete: verify through lovelace/resources
  • content update: verify through lovelace/config
  • content update must confirm both the intended field change and unrelated-view survival
  1. If verification fails, stop and report the mismatch. Do not retry by guessing.

Output Format

For list/read:

  • Dashboard
  • Target
  • Summary
  • relevant config or inventory excerpt only

For create/update/delete:

  • Dashboard
  • Mode
  • Planned change
  • Verification
  • Next step

Do not dump the full dashboard JSON/YAML by default.

Safety

  • No guessed url_path or dashboard_id values.
  • Create/update uses natural confirmation after preview.
  • Dashboard/resource delete uses exact token confirmation only.
  • If the requested change would require a broad re-layout instead of a targeted edit, say so before writing.

Guardrails

  • Never call lovelace/config/save with a partial config.
  • Never use lovelace/info to decide whether a dashboard is writable.
  • Never use lovelace/config/delete as the dashboard delete path.
  • Never verify only by save success; always read back the dashboard.
  • Never probe a different dashboard's config just to infer behavior for the target dashboard.
  • Never invent a new custom-card schema just because a resource exists.
  • If the dashboard target is still ambiguous after one clarification, stop and explain the remaining ambiguity.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet, be the first.

Versions

  • v0.1.0 Imported from the upstream source.