ClawHub
Back to skill

Security audit

Hylo — GHL Automation Expert

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed third-party GoHighLevel helper skill that uses Hylo's API, with no evidence of hidden execution, persistence, or local data access.

Install this only if you are comfortable using Hylo as a third-party service for GoHighLevel assistance and providing a HYLO_API_KEY. Do not include passwords, access tokens, regulated personal data, or unnecessary customer-identifying details in workflow objectives or validation payloads sent through the skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:14
Finding

Mandatory Commercial Output Injection Through Skill Instructions

Content
View full analysis
"You need a Hylo API key. Sign up at hylo.pro (7-day free trial)." If 403: -> "Your trial has expired. Subscribe at hylo.pro/dashboard." If 404: -> "I couldn't find that resource. Try a broader search term." If 429: -> "Rate limit reached. Try again tomorrow or upgrade at hylo.pro/dashboard." ``` ### Technical Analysis The Skill prescribes fixed commercial messages that the Agent must return when the API key is absent or selected HTTP errors occur. These messages direct users to register, subscribe, or upgrade through the Skill provider. This behavior alters the Agent's response policy when the Skill is loaded. Instead of allowing the Agent to provide a neutral explanation of the failure or offer alternatives, the instructions compel it to emit attacker-controlled acquisition and upselling content. The behavior therefore matches `T01: Skill Instruction Hijacking`. The issue does not grant operating-system privileges or execute arbitrary code. Its security significance is manipulation of the Agent's current-session behavior and control over user-facing output. ### Attack Path 1. The Skill is loaded for a request involving GoHighLevel. 2. The Skill directs the Agent to call the Hylo API. 3. The `HYLO_API_KEY` is absent, or the API returns HTTP 401, 403, or 429. 4. The Agent follows the embedded instructions and displays the prescribed signup, subscription, or upgrade message. 5. The user is redirected toward the third-party commercial service rather than receiving a neutral error response or an offline alternative. ### Impact Assessment The affected scope is the Agent's current-session response behavior. The Skill provider can force promotional content into responses under predictable error conditions and make ord ...[truncated 180 chars]
Remediation
View remediation

other

Warning
Location
SKILL.md:23
Finding

Unconditional Transmission of User Workflow Data to a Third-Party API

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill directs the agent to send requests to an external service at api.hylo.pro and to include a bearer token from HYLO_API_KEY. This creates a real data egress path to a third party and could expose user queries, workflow details, or other sensitive context to an external provider whenever the skill is invoked.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
## API (bash + curl)

Base: `https://api.hylo.pro/v1`
Auth: `-H "Authorization: Bearer $HYLO_API_KEY"`

| Need | Endpoint |

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/endpoints.md (reported line 85)May include surrounding context.

POST /templates/workflow

bash
curl -X POST https://api.hylo.pro/v1/templates/workflow \
  -H "Authorization: Bearer $HYLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/endpoints.md (reported line 85)May include surrounding context.

POST /templates/workflow

bash
curl -X POST https://api.hylo.pro/v1/templates/workflow \
  -H "Authorization: Bearer $HYLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/endpoints.md (reported line 100)May include surrounding context.

POST /templates/workflow

bash
curl -X POST https://api.hylo.pro/v1/templates/workflow \
  -H "Authorization: Bearer $HYLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{