Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Hedy API helper for reading and managing meeting data, with explicit confirmations for writes, deletes, and webhooks.
Install only if you trust Hedy with the meeting data available to the API key. Be especially careful when creating webhooks: confirm the exact destination domain and events, because matching meeting-derived data may leave Hedy and continue being delivered until the webhook is deleted.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Returns HTTP 200 with the updated topic object.
### DELETE /topics/{topicId}
Delete a topic. Sessions under this topic are unlinked (topicId set to null) but not deleted.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Returns HTTP 200 with the updated context object.
### DELETE /contexts/{contextId}
Delete a session context. If the deleted context was the default, the most recently updated remaining context is promoted to default.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Delivered webhook bodies are flat: event fields sit beside the top-level `event`, with no nested `data` object and no top-level delivery timestamp. Session webhook fields use camelCase such as `sessionType`, `topicId`, and `topicName`, while REST Session responses use `session_type` and a nested `topic`. Current `session.ended` and `session.exported` payloads can include `session_notes`, `structured_conversations`, and Topic fields; older Hedy clients may emit reduced payloads.
### DELETE /webhooks/{webhookId}
Delete a webhook.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
-> Confirm with user, then POST /topics with name "Client Calls" and color "#4A90D9".
**"Delete the Project Alpha topic"**
-> GET /topics to find the ID, confirm with user showing the topic name and session count, then DELETE /topics/{id}.
**"Set up a webhook for new highlights"**
-> Confirm the URL with user, then POST /webhooks with events ["highlight.created"].
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Update a stable-ID todo's completion state, due date, or both. An empty dueDate clears the due date.
curl -s -X PATCH -H "Authorization: Bearer $HEDY_API_KEY" -H "Content-Type: application/json" \
-d '{"completed": true, "dueDate": "Friday"}' \
"{BASE_URL}/sessions/{sessionId}/todos/{todoId}" | jq
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Update a stable-ID todo's completion state, due date, or both. An empty dueDate clears the due date.
curl -s -X PATCH -H "Authorization: Bearer $HEDY_API_KEY" -H "Content-Type: application/json" \
-d '{"completed": true, "dueDate": "Friday"}' \
"{BASE_URL}/sessions/{sessionId}/todos/{todoId}" | jq
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Update a stable-ID todo's completion state, due date, or both. An empty dueDate clears the due date.
curl -s -X PATCH -H "Authorization: Bearer $HEDY_API_KEY" -H "Content-Type: application/json" \
-d '{"completed": true, "dueDate": "Friday"}' \
"{BASE_URL}/sessions/{sessionId}/todos/{todoId}" | jq
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Replace the complete custom vocabulary list. Terms omitted from the request are removed; omit enabled to preserve its stored value.
curl -s -X PUT -H "Authorization: Bearer $HEDY_API_KEY" -H "Content-Type: application/json" \
-d '{"terms": ["Hedy", "Portkey"], "enabled": true}' \
"{BASE_URL}/vocabulary" | jq
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new topic. Response is wrapped in { success, data }.
curl -s -X POST -H "Authorization: Bearer $HEDY_API_KEY" -H "Content-Type: application/json" \
-d '{"name": "Project Alpha", "description": "All about Project Alpha", "color": "#FF5733"}' \
"{BASE_URL}/topics" | jq
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create a new topic. Response is wrapped in { success, data }.
curl -s -X POST -H "Authorization: Bearer $HEDY_API_KEY" -H "Content-Type: application/json" \
-d '{"name": "Project Alpha", "description": "All about Project Alpha", "color": "#FF5733"}' \
"{BASE_URL}/topics" | jq
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"id": "wh_123",
"url": "https://api.example.com/hedy-webhook",
"events": ["session.ended", "highlight.created"],
"createdAt": "2026-02-01T10:00:00Z",
"updatedAt": "2026-02-01T10:00:00Z"
Creating webhooks can cause future meeting-derived data, including transcripts, notes, highlights, todos, and suggestions, to be sent to an arbitrary external URL controlled by the user or an attacker. Even though the skill warns about this, it materially expands the data-exfiltration surface beyond the first-party Hedy API and could leak sensitive meeting content if the destination is malicious or misconfigured.
Create a webhook. Rate limited to 5 per minute. Maximum 50 webhooks per user. Requires HTTPS URL in production.
curl -s -X POST -H "Authorization: Bearer $HEDY_API_KEY" -H "Content-Type: application/json" \
-d '{"url": "https://api.example.com/hedy-webhook", "events": ["session.ended", "highlight.created"]}' \
"{BASE_URL}/webhooks" | jq
This example shows posting a webhook destination that will receive meeting-derived events and potentially sensitive content over time. In context, webhook support is a real capability that can route user data outside Hedy to third-party infrastructure, making it a genuine exfiltration risk if an unsafe URL is approved.
curl -s -X POST -H "Authorization: Bearer $HEDY_API_KEY" -H "Content-Type: application/json" \
-d '{"url": "https://api.example.com/hedy-webhook", "events": ["session.ended", "highlight.created"]}' \
"{BASE_URL}/webhooks" | jq
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
2. **Confirm deletions twice.** For DELETE requests, state the target (topic name, context title, webhook URL) and ask "Are you sure?" before proceeding.
3. **Extra caution for webhooks.** Creating a webhook can send future meeting-derived data, including transcripts, recaps, notes, highlights, todos, and suggestions, to an external URL. Before creating one, explicitly confirm the exact destination host and events, and warn that the corresponding data will leave Hedy.
4. **Never display, log, or include the API key** in any output, message, file, or code block shown to the user.
5. **Never prompt the user to paste their API key in chat.** Direct them to configure it in `~/.openclaw/openclaw.json`.
6. **Respect rate limits.** On 429 responses, wait before retrying. Do not loop.
7. **Present data clearly.** Format session transcripts, highlights, and todos in a readable way. Use markdown tables or lists as appropriate.
8. **Handle missing data gracefully.** Some fields (transcript, cleaned_transcript, recap, topic) may be null or empty. Do not treat this as an error.
No suspicious patterns detected.