Hedy

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only Hedy API skill is coherent, but it grants the agent access to sensitive meeting records and some Hedy account-management features through your API key.

Install this skill if you want OpenClaw to access your Hedy meeting data. Before using it, confirm the region is correct, protect the Hedy API key, and be deliberate about requests that retrieve many transcripts or change topics, contexts, or webhooks.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent with this key can access the Hedy API permissions associated with it.

Why it was flagged

The skill uses a bearer API key for the user's Hedy account; this is expected for the integration but grants delegated account access.

Skill content

Every request requires: Authorization: Bearer {HEDY_API_KEY}

Recommendation

Use a revocable or least-privileged Hedy API key if available, keep it out of chat/output/logs, and rotate it if exposed.

Note

ASI06: Memory and Context Poisoning

What this means

The agent may process sensitive meeting content, summaries, decisions, and todos when you ask it to use this skill.

Why it was flagged

The skill retrieves meeting transcripts and AI-generated meeting outputs, which may contain confidential business or personal information and will enter the agent's working context.

Skill content

Full session detail including transcript, AI outputs, highlights, and todos.

Recommendation

Only use it for meetings you are comfortable exposing to the agent session, and avoid requesting broad transcript retrieval unless needed.

Note

ASI02: Tool Misuse and Exploitation

What this means

If asked to make changes, the agent could alter Hedy organizational settings or webhook configuration rather than only reading meeting data.

Why it was flagged

The skill includes Hedy account-management capabilities, including webhook-related operations; this is disclosed and purpose-aligned but can have persistent account effects.

Skill content

Manage topics, session contexts, and webhooks.

Recommendation

Review and explicitly approve any topic, context, or webhook changes, especially anything that sends data to external URLs.