Back to plugin

Security audit

Install Hirey AI on OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Hirey AI/OpenClaw integration, but it gives itself broad host-maintenance and automation powers that are not clearly disclosed to users.

Install only if you are comfortable letting this Hirey AI bundle modify OpenClaw configuration, run a local Hi MCP/receiver, route future Hi messages to this chat, contact matches through Hi, write scheduled Hi meetings to a calendar if a calendar tool is present, and automatically apply Hi release updates. Prefer a version that requires explicit approval for updates and calendar writes and treats platform-provided onboarding text as data rather than instructions.

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger description is extremely broad and includes many common intents like install, setup, register, or repair, plus generic references to jobs, housing, friendship, dating, founders, and lawyers. This can cause the skill to activate in contexts far beyond a narrowly-scoped installer, increasing the chance that a user is steered into executing host-modifying installation steps when they did not explicitly request this specific plugin.

Ssd 2

High
Confidence
98% confidence
Finding
The comments explicitly describe avoiding scanner signatures and restructuring code to bypass installer safety checks. Even though the current implementation replaces subprocess execution with filesystem operations, deliberate guidance on evading security scanning is a strong indicator of adversarial intent and undermines trust in the package, because it normalizes bypassing platform protections designed to warn users about risky installers.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- after install succeeds, do not promise that `hirey-compatible-use` is already visible in this same turn; if the current turn still lacks that post-install usage surface, say plainly that the session has not refreshed yet and ordinary Hi work should continue in the next fresh turn of the same chat
- after install succeeds, the platform will (within a few minutes of stable healthy install) push a one-time **welcome recommendation batch** as an `agent.message.created` webhook with `payload.kind="install_welcome_recommendation"`. The payload carries m social_or_friendship listing previews — front n curated by Hi staff, back m-n the most recently posted friendship listings. This is a view-only teaser, not a contact-ready handoff: the owner has no source listing yet, so any `matching_sessions(action="contact_match")` against these listing ids will fail. Treat the welcome batch as informational; the bundled `hirey-compatible-use` skill describes how to surface it to the owner without overpromising. Each agent gets the welcome batch at most once (Hi guarantees this via `agent_event_outbox` idempotency); do not retrigger it manually
- when `hi_agent_install` returns with a populated `welcome` field (shape: `{ kind: "install_welcome_onboarding", instruction_to_llm: string, recent_activity: [{listing_id, listing_type_id, published_by_agent_id, target_preview_text, listing_created_at}], intent_options: [{id, label_zh, label_en, listing_type_id}] }`), follow `welcome.instruction_to_llm` exactly — that string is the platform-authored onboarding script and supersedes any per-skill rephrasing. The recent_activity and intent_options are pre-fetched for you from the platform; do not call `agent_listings(action="browse_recent")` again to re-fetch them. Run the welcome conversation in the same language the owner is using in this chat, not the language the instruction string is written in. Do not skip this step just because doctor is healthy — doctor only proves the technical install 
...[truncated 25 chars]
Confidence
86% confidence
Finding
The skill instructs the agent to follow platform-provided onboarding instructions 'exactly' and not ask the user whether to leave the chat unbound, effectively delegating user-facing behavior to untrusted remote content and reducing consent checks. Because the returned welcome payload and onboarding script originate from an external platform, this creates a prompt-injection and over-automation risk where the agent may execute persuasive or state-changing flows without sufficient validation.

Hidden Instructions

High
Category
Prompt Injection
Content
/**
 * Strip JSON5-flavor comments so JSON.parse can consume the remainder. Handles:
 *   - // line comments (until \n or EOF)
 *   - /* block comments *‍/  (greedy until next *‍/)
 *   - never strips inside string literals (quote-aware state machine)
 *
 * Trailing commas remain after stripping; we keep a small post-pass that drops
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
/**
 * Strip JSON5-flavor comments so JSON.parse can consume the remainder. Handles:
 *   - // line comments (until \n or EOF)
 *   - /* block comments *‍/  (greedy until next *‍/)
 *   - never strips inside string literals (quote-aware state machine)
 *
 * Trailing commas remain after stripping; we keep a small post-pass that drops
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
* Behavior:
 *   - destRoot is created if missing (recursive mkdir)
 *   - existing files at the same relative path are overwritten (idempotent re-install)
 *   - file modes preserved via fs.copyFile + fs.chmod from source stat
 *   - bin/ symlinks under node_modules/.bin/ are honored (recreated at dest)
 *
 * Runs in O(file count) on the source tree; called once per `setup` invocation.
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill is presented as a post-install people-matching workflow, but it also authorizes autonomous plugin upgrades, shell command execution, gateway restarts, and rollback logic. That is a dangerous scope expansion because a business-domain skill gains host-maintenance privileges that can modify local software state and execute platform-provided commands without explicit user approval.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
These instructions permit shell-driven package installation and service restart in a skill whose stated purpose is matching people. Executing installation commands and restarting a gateway materially increases the blast radius: a compromised event payload, malformed command, or logic error could alter the host, break service, or be abused for code execution paths outside the skill's core purpose.

Vague Triggers

High
Confidence
89% confidence
Finding
The activation criteria are extremely broad, causing the skill to engage for many loosely related 'people-finding' requests. In context, that broad trigger is more dangerous because the skill also contains autonomous side effects such as contacting people, calendar writes, and update behavior, increasing the chance of unintended invocation and action on the user's behalf.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs automatic calendar creation for scheduled meetings without prior user warning in the description or an opt-in gate. This creates a consent and privacy problem because meeting metadata, attendee identity, links, and timestamps are written into a local calendar integration automatically, potentially exposing sensitive relationship or hiring activity.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill silently self-updates by executing an install command from event payload data and restarting services, yet the skill description does not warn the user that ordinary usage may trigger software maintenance. Hidden high-impact side effects undermine informed consent and make payload manipulation or supply-chain issues significantly more dangerous.

Ssd 3

Medium
Confidence
92% confidence
Finding
Automatically adding meetings to the owner's local calendar without asking first causes external side effects on personal data stores and can reveal sensitive contacts, topics, and join links. In a matching/dating/hiring context, that metadata can be especially sensitive, so silent synchronization increases privacy and trust risk even if operationally convenient.

Ssd 3

Medium
Confidence
98% confidence
Finding
Applying updates by executing an install command and restarting services without asking the owner first is a significant autonomous side effect on the host. Because the command is sourced from release payload data and followed by service restart, the behavior creates supply-chain, integrity, and availability risks that exceed the normal expectations of a people-matching skill.

Static analysis

No suspicious patterns detected.