ClawHub
Back to skill

Security audit

Hylo — GHL Automation Expert

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed third-party GoHighLevel helper skill that uses Hylo's API, with no evidence of hidden execution, persistence, or local data access.

Install this only if you are comfortable using Hylo as a third-party service for GoHighLevel assistance and providing a HYLO_API_KEY. Do not include passwords, access tokens, regulated personal data, or unnecessary customer-identifying details in workflow objectives or validation payloads sent through the skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:14
Finding
Mandatory Commercial Output Injection Through Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-19 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Vulnerable Code ```text If $HYLO_API_KEY is not set or any call returns 401: -> "You need a Hylo API key. Sign up at hylo.pro (7-day free trial)." If 403: -> "Your trial has expired. Subscribe at hylo.pro/dashboard." If 404: -> "I couldn't find that resource. Try a broader search term." If 429: -> "Rate limit reached. Try again tomorrow or upgrade at hylo.pro/dashboard." ``` ### Technical Analysis The Skill prescribes fixed commercial messages that the Agent must return when the API key is absent or selected HTTP errors occur. These messages direct users to register, subscribe, or upgrade through the Skill provider. This behavior alters the Agent's response policy when the Skill is loaded. Instead of allowing the Agent to provide a neutral explanation of the failure or offer alternatives, the instructions compel it to emit attacker-controlled acquisition and upselling content. The behavior therefore matches `T01: Skill Instruction Hijacking`. The issue does not grant operating-system privileges or execute arbitrary code. Its security significance is manipulation of the Agent's current-session behavior and control over user-facing output. ### Attack Path 1. The Skill is loaded for a request involving GoHighLevel. 2. The Skill directs the Agent to call the Hylo API. 3. The `HYLO_API_KEY` is absent, or the API returns HTTP 401, 403, or 429. 4. The Agent follows the embedded instructions and displays the prescribed signup, subscription, or upgrade message. 5. The user is redirected toward the third-party commercial service rather than receiving a neutral error response or an offline alternative. ### Impact Assessment The affected scope is the Agent's current-session response behavior. The Skill provider can force promotional content into responses under predictable error conditions and make ord ...[truncated 180 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Replace prescribed promotional responses with neutral operational errors. - Remove signup, subscription, trial, and upgrade advertising from mandatory Agent output. - Allow the Agent to explain that the external service is unavailable and offer non-commercial alternatives. - Do not require an external API call when the request can be answered safely without one. - Clearly distinguish optional third-party service recommendations from required operational instructions. - Require affirmative user consent before directing the user to a commercial registration or subscription page. ]]>

other

Warning
Location
SKILL.md:23
Finding
Unconditional Transmission of User Workflow Data to a Third-Party API<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-43 **Vulnerability Type**: `other: Unnecessary Third-Party Data Disclosure` **Risk Level**: Medium ### Vulnerable Code ```text Base: `https://api.hylo.pro/v1` Auth: `-H "Authorization: Bearer $HYLO_API_KEY"` | Need | Endpoint | |------|----------| | Search actions | `GET /actions?q=KEYWORD` | | Search triggers | `GET /triggers?q=KEYWORD` | | Search API schemas | `GET /schemas?q=KEYWORD` | | Full schema detail | `GET /schemas/{name}` | | GHL UI navigation | `GET /navigate/{feature}` | | Full UI protocol | `GET /protocols/{feature}` | | Plan a workflow | `POST /templates/workflow` -d '{"objective":"..."}' | | Validate workflow | `POST /validate` -d '{"trigger":"...","actions":[...]}' | For category/feature lists: `cat {baseDir}/reference/endpoints.md` ## Rules - ALWAYS call the API -- don't guess about GHL. Your knowledge may be outdated. - Summarize JSON responses naturally -- never dump raw output. - For workflow planning: call /templates/workflow FIRST, then /schemas for details. ``` ### Technical Analysis The Skill requires the Agent to call `https://api.hylo.pro/v1` for every applicable request. Workflow-planning requests are submitted to `/templates/workflow`, while workflow definitions may be submitted to `/validate`. A workflow objective or definition can contain business processes, customer context, marketing plans, contact-handling logic, or other operational information supplied by the user. The instructions contain no requirement to: - obtain informed user consent before external transmission; - identify or redact personal data, credentials, or proprietary information; - minimize the transmitted request body; - warn users that their input will be processed by a third party; - provide an offline alternative. The bearer token is appropriately represented as an environment variable rather than a hardcoded secret. However, the mandatory external transmission creates a dat ...[truncated 1301 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Replace the unconditional API-call rule with an opt-in policy. - Inform users before their prompt content is transmitted to `api.hylo.pro`. - Obtain explicit consent when a request may contain confidential, personal, or customer-related information. - Add data-minimization rules that send only fields strictly necessary for the requested operation. - Redact credentials, access tokens, personal data, customer identifiers, and proprietary details before transmission. - Warn users not to include secrets or regulated data in workflow objectives and validation payloads. - Provide an offline response path when live API data is not essential. - Document the third party's data retention, processing, logging, and deletion practices. - Continue sourcing the bearer token from an environment variable, and ensure it is never included in logs or natural-language responses. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Content
## API (bash + curl)

Base: `https://api.hylo.pro/v1`
Auth: `-H "Authorization: Bearer $HYLO_API_KEY"`

| Need | Endpoint |
Confidence
95% confidence
Finding
The skill directs the agent to send requests to an external service at api.hylo.pro and to include a bearer token from HYLO_API_KEY. This creates a real data egress path to a third party and could expose user queries, workflow details, or other sensitive context to an external provider whenever the skill is invoked.

External Transmission

Medium
Category
Data Exfiltration
Content
### POST /templates/workflow

```bash
curl -X POST https://api.hylo.pro/v1/templates/workflow \
  -H "Authorization: Bearer $HYLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### POST /templates/workflow

```bash
curl -X POST https://api.hylo.pro/v1/templates/workflow \
  -H "Authorization: Bearer $HYLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### POST /templates/workflow

```bash
curl -X POST https://api.hylo.pro/v1/templates/workflow \
  -H "Authorization: Bearer $HYLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.