ClawHub
Back to skill

Security audit

Heyy

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Heyy integration that uses the OOMOL oo CLI to read and update Heyy data, with explicit confirmation rules for writes and no hidden bundled code.

Install this only if you trust OOMOL and want your agent to operate your Heyy account through the oo CLI. Review write requests carefully before approving contact, label, or attribute changes, and use the remote CLI installer only from a trusted environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The instruction to use this skill for "ANY Heyy request" is overly broad and can cause the agent to invoke the skill in situations where a narrower, task-specific capability would be safer or more appropriate. Because this skill includes both read and write actions, broad routing increases the chance of unintended state-changing operations, especially when the user intent is ambiguous or insufficiently confirmed.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.