🎁 Get the FREE AI Skills Starter Guide β€” Subscribe β†’
BytesAgainBytesAgain
πŸ¦€ ClawHub

Starling Home Hub (Nest/Google Home)

by @michaeljmoody

Controls Nest and Google Home smart home devices via the Starling Home Hub's local REST API. Supports thermostats, cameras, Nest Protects, Nest Γ— Yale locks, temperature sensors, home/away control, and Nest weather service. Use this skill when managing Nest/Google Home devices through Starling Home Hub β€” reading device status, setting temperatures, getting camera snapshots, locking/unlocking doors, checking smoke/CO alerts, and toggling home/away mode.

Versionv1.0.2
Downloads2,002
Stars⭐ 2
TERMINAL
clawhub install starling-home-hub

πŸ“– About This Skill


name: starling-home-hub description: Controls Nest and Google Home smart home devices via the Starling Home Hub's local REST API. Supports thermostats, cameras, Nest Protects, Nest Γ— Yale locks, temperature sensors, home/away control, and Nest weather service. Use this skill when managing Nest/Google Home devices through Starling Home Hub β€” reading device status, setting temperatures, getting camera snapshots, locking/unlocking doors, checking smoke/CO alerts, and toggling home/away mode. homepage: https://starlinghome.io env: - name: STARLING_HUB_IP required: true secret: false description: Local IP address of your Starling Home Hub (e.g. 192.168.1.151) - name: STARLING_API_KEY required: true secret: true description: API key from the Starling Home Hub app (Developer Connect section)

Starling Home Hub (Nest/Google Home)

> Community skill β€” not affiliated with or endorsed by Starling LLC, Google, Nest, or Apple. Nest is a trademark of Google LLC. Starling Home Hub is a product of Starling LLC. This skill requires a Starling Home Hub with firmware 8.0+ and the Developer Connect API enabled.

Overview

Control Nest smart home devices through the Starling Home Hub Developer Connect (SDC) local REST API using the starling.sh script.

Required Environment Variables

| Variable | Required | Secret | Description | |----------|----------|--------|-------------| | STARLING_HUB_IP | Yes | No | Local IP address of your Starling Home Hub (e.g. 192.168.1.151) | | STARLING_API_KEY | Yes | Yes | API key created in the Starling Home Hub app (Developer Connect section) |

Setup

Set these environment variables (never hardcode keys in scripts):

export STARLING_HUB_IP="192.168.1.xxx"
export STARLING_API_KEY="your-api-key"     # From Starling Home Hub app

The script is at: scripts/starling.sh

Options: --http (downgrade to HTTP β€” not recommended), --raw (skip jq formatting)

HTTPS is the default. The script uses port 3443 unless --http is specified.

Security

API Key Management

  • Always use the STARLING_API_KEY env var β€” never pass keys via --key (visible in ps output)
  • Never store keys in scripts, SKILL.md, or version-controlled files
  • Use a .env file with restricted permissions: chmod 600 .env
  • Consider a secrets manager for production/automated setups
  • Least Privilege

  • Create API keys with minimum required permissions in the Starling Home Hub app
  • Use read-only keys unless you need to set properties or access camera streams
  • Create separate keys for different automation tasks if possible
  • TLS Certificate Verification

  • HTTPS is the default, but the script uses curl -k (skip cert verification) because Starling Home Hub uses a self-signed certificate
  • This is acceptable on a trusted local network but increases MITM risk on untrusted networks
  • To pin the hub's certificate instead: starling.sh --cacert /path/to/hub-cert.pem status
  • When --cacert is provided, -k is not used and full certificate verification applies
  • API Key in URL

  • The Starling Developer Connect API requires the key as a URL query parameter (?key=...) β€” this is the API's design, not a skill choice
  • URL query parameters can appear in access logs and browser history β€” this is mitigated by the API being local-only (no intermediary proxies/CDNs)
  • Always use HTTPS to encrypt the key in transit on your local network
  • Network Security

  • The Starling API is local network only by design β€” no cloud exposure
  • Never port-forward 3080 or 3443 to the internet
  • Always use HTTPS (default) to prevent local network sniffing of API keys and device data
  • Snapshot Handling

  • Camera snapshots contain sensitive imagery β€” don't store in world-readable locations
  • The script sets snapshot files to chmod 600 (owner-only) automatically
  • Clean up temporary snapshot files when no longer needed
  • Best Practices

    Always Check Status First

    Before making device calls, verify the hub is ready:
    scripts/starling.sh status
    
    Confirm apiReady: true and connectedToNest: true before proceeding.

    Respect Rate Limits

    These limits are enforced by the Nest cloud:
  • POST (set properties): max once per second per device
  • Snapshot: max once per 10 seconds per camera
  • GET (read properties/device list): no cloud rate limit (local cache)
  • Idempotent Operations

    Safe to retry without side effects:
  • All GET operations (status, devices, device, get, snapshot)
  • SET operations with the same values (setting temp to 22 when already 22)
  • stream-extend (just resets the keepalive timer)
  • Not idempotent: stream-start (creates a new stream each time)

    Error Handling

    The script provides actionable error messages:
  • 401: Check API key and permissions β€” key is never exposed in error output
  • 404: Verify device ID and property name
  • 400: Check parameter values and types
  • Common Workflows

    List All Devices

    scripts/starling.sh devices
    

    Read Device Properties

    scripts/starling.sh device           # All properties
    scripts/starling.sh get    # Single property
    

    Set Device Properties

    scripts/starling.sh set  key=value [key=value...]
    

    Camera Snapshots

    scripts/starling.sh snapshot  --output photo.jpg --width 1280
    

    Camera Streaming (WebRTC)

    scripts/starling.sh stream-start  
    scripts/starling.sh stream-extend     # Every 60s
    scripts/starling.sh stream-stop  
    

    Common Tasks

    Set thermostat to 22Β°C:

    scripts/starling.sh set  targetTemperature=22
    

    Set HVAC mode:

    scripts/starling.sh set  hvacMode=heat
    

    Check for motion on camera:

    scripts/starling.sh get  motionDetected
    

    Lock/unlock a door:

    scripts/starling.sh set  targetState=locked
    

    Get camera snapshot:

    scripts/starling.sh snapshot  --output front-door.jpg
    

    Check smoke/CO status:

    scripts/starling.sh get  smokeDetected
    scripts/starling.sh get  coDetected
    

    Set home/away:

    scripts/starling.sh set  homeState=away
    

    API Reference

    See references/api-reference.md for full device property details, writable properties, error codes, and endpoint documentation.

    βš™οΈ Configuration

    Set these environment variables (never hardcode keys in scripts):

    export STARLING_HUB_IP="192.168.1.xxx"
    export STARLING_API_KEY="your-api-key"     # From Starling Home Hub app
    

    The script is at: scripts/starling.sh

    Options: --http (downgrade to HTTP β€” not recommended), --raw (skip jq formatting)

    HTTPS is the default. The script uses port 3443 unless --http is specified.

    πŸ“‹ Tips & Best Practices

    Always Check Status First

    Before making device calls, verify the hub is ready:
    scripts/starling.sh status
    
    Confirm apiReady: true and connectedToNest: true before proceeding.

    Respect Rate Limits

    These limits are enforced by the Nest cloud:
  • POST (set properties): max once per second per device
  • Snapshot: max once per 10 seconds per camera
  • GET (read properties/device list): no cloud rate limit (local cache)
  • Idempotent Operations

    Safe to retry without side effects:
  • All GET operations (status, devices, device, get, snapshot)
  • SET operations with the same values (setting temp to 22 when already 22)
  • stream-extend (just resets the keepalive timer)
  • Not idempotent: stream-start (creates a new stream each time)

    Error Handling

    The script provides actionable error messages:
  • 401: Check API key and permissions β€” key is never exposed in error output
  • 404: Verify device ID and property name
  • 400: Check parameter values and types