T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:214- Finding
Platform-Controlled Runtime Instructions Can Hijack Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Install Hirey AI on OpenClaw
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Hi/OpenClaw installer, but it grants persistent host configuration authority and delegates part of the agent workflow to remote platform-supplied instructions.
Review before installing. This installer changes persistent OpenClaw host configuration, stores hook tokens, and may alter approval behavior. Only proceed if you trust the Hirey AI platform to supply onboarding instructions safely, and ensure ~/.openclaw/openclaw.json remains readable only by your user after installation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/openclaw-config-fs.mjs:151- Finding
Atomic Configuration Rewrite Can Weaken Permissions on Secret-Bearing Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (28)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md nstalled, this same skill becomes available locally; Stage B will then resolve `./scripts/openclaw-host-installer.mjs` relative to this `SKILL.md` to do the Ope
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md nstalled, this same skill becomes available locally; Stage B will then resolve `./scripts/openclaw-host-installer.mjs` relative to this `SKILL.md` to do the Ope
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md nstalled, this same skill becomes available locally; Stage B will then resolve `./scripts/openclaw-host-installer.mjs` relative to this `SKILL.md` to do the Ope
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md nstalled, this same skill becomes available locally; Stage B will then resolve `./scripts/openclaw-host-installer.mjs` relative to this `SKILL.md` to do the Ope
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md nstalled, this same skill becomes available locally; Stage B will then resolve `./scripts/openclaw-host-installer.mjs` relative to this `SKILL.md` to do the Ope
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md e B will then resolve `./scripts/openclaw-host-installer.mjs` relative to this `SKILL.md` to do the OpenClaw-side host config writes (a step the ClawPack path d
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md e B will then resolve `./scripts/openclaw-host-installer.mjs` relative to this `SKILL.md` to do the OpenClaw-side host config writes (a step the ClawPack path d
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md e B will then resolve `./scripts/openclaw-host-installer.mjs` relative to this `SKILL.md` to do the OpenClaw-side host config writes (a step the ClawPack path d
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
js /** * Strip JSON5-flavor comments so JSON.parse can consume the remainder. Handles: * - // line comments (until \n or EOF) * - /* block comments */ (greedy until next */) * - never strips inside string literals (quote-aware state machine) * * Trailing commas remain after stripping; we keep a small post-pass that drops
Ssd 2
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The comments explicitly state an intent to evade the plugin install scanner's regex detection for dangerous subprocess patterns, including avoiding specific API names so the installer will not be flagged. Even though this file no longer imports
child_process, designing code and documentation around bypassing security scanning is a strong indicator of adversarial behavior and undermines trust in the package's safety posture; in a skill installer context, that is especially dangerous because it targets user-host installation flows.- Content
Ae3
High
- Category
- analysis-evasion
- Confidence
- 90% confidence
- Finding
Text artifact contains embedded NUL bytes
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 84% confidence
- Finding
The recursive copy routine recreates symlinks from the source tree without validating the link target, so a malicious or tampered vendor tree could plant symlinks pointing outside the destination and influence later execution or file access. It also preserves source mode bits wholesale, which can make attacker-supplied files executable in the installed tree, increasing the impact of a poisoned source bundle.
- Content
js * Behavior: * - destRoot is created if missing (recursive mkdir) * - existing files at the same relative path are overwritten (idempotent re-install) * - file modes preserved via fs.copyFile + fs.chmod from source stat * - bin/ symlinks under node_modules/.bin/ are honored (recreated at dest) * * Runs in O(file count) on the source tree; called once per `setup` invocation.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description says to use the skill whenever the user wants to 'install, set up, register, or repair' Hirey AI and also describes very broad end-user intents like jobs, housing, friendship, dating, founders, investors, lawyers, and 'any human-lead search.' This wide phrasing lacks tighter trigger constraints and could overlap with many ordinary conversations, increasing the risk of unintended invocation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 87% confidence
- Finding
The skill instructs the agent to have the user paste a shell snippet that changes OpenClaw approval policy, weakening an execution-control boundary to permit future installs more easily. Even though the allowlist is scoped, modifying approval settings creates persistent session/host state and can reduce protections against unintended command execution if misapplied or broadened later.
- Content
JSON
text Tell the user in plain language: "Before installing Hi, please paste the snippet below into your shell once — it tells OpenClaw to skip the per-attempt approval prompt for `openclaw plugins install clawhub:hirey*` only. The change is live (no gateway restart). Then send another message to continue installing." Then STOP. Do not try to call the install command from this turn — without the allowlist you will burn 4–6 turns on a token-paste loop. Do not try to write the approvals file via your own `exec` either; that write is itself subject to the same gate and will just shift the loop one level. If `openclaw approvals get` already shows an allowlist entry whose `argPattern` matches `clawhub:hirey`, OR effective `security=full` / `ask=off` on a developer host, skip the pre-flight and proceed directly to the install command below.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - use the official Hi packages at the current pinned public release versions: `@hirey-ai/mcp-server@0.1.19` and, when local durable delivery is enabled, `@hirey-ai/agent-receiver@0.1.11` - install the Hi npm packages into a user-writable vendor dir under `~/.openclaw/vendor/hi`; do not rely on `npm -g`, `sudo`, or any elevated install path - mount `hirey-ai-mcp-server` from that vendor dir as a local `stdio` MCP child process - for ordinary user installs, always set `HI_PLATFORM_BASE_URL=https://hi.hirey.ai`; this public domain is the only supported default target, so do not ask the user to choose an environment or provide a URL - keep `HI_MCP_TRANSPORT=stdio` - keep `HI_MCP_PROFILE=openclaw-main` unless the user explicitly wants a different stable profile - for the default OpenClaw profile, set `HI_MCP_STATE_DIR=~/.openclaw/hi-mcp/openclaw-main`; this must be the profile-scoped leaf directory, not the bare parent `~/.openclaw/hi-mcp`
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - use the official Hi packages at the current pinned public release versions: `@hirey-ai/mcp-server@0.1.19` and, when local durable delivery is enabled, `@hirey-ai/agent-receiver@0.1.11` - install the Hi npm packages into a user-writable vendor dir under `~/.openclaw/vendor/hi`; do not rely on `npm -g`, `sudo`, or any elevated install path - mount `hirey-ai-mcp-server` from that vendor dir as a local `stdio` MCP child process - for ordinary user installs, always set `HI_PLATFORM_BASE_URL=https://hi.hirey.ai`; this public domain is the only supported default target, so do not ask the user to choose an environment or provide a URL - keep `HI_MCP_TRANSPORT=stdio` - keep `HI_MCP_PROFILE=openclaw-main` unless the user explicitly wants a different stable profile - for the default OpenClaw profile, set `HI_MCP_STATE_DIR=~/.openclaw/hi-mcp/openclaw-main`; this must be the profile-scoped leaf directory, not the bare parent `~/.openclaw/hi-mcp`
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - use the official Hi packages at the current pinned public release versions: `@hirey-ai/mcp-server@0.1.19` and, when local durable delivery is enabled, `@hirey-ai/agent-receiver@0.1.11` - install the Hi npm packages into a user-writable vendor dir under `~/.openclaw/vendor/hi`; do not rely on `npm -g`, `sudo`, or any elevated install path - mount `hirey-ai-mcp-server` from that vendor dir as a local `stdio` MCP child process - for ordinary user installs, always set `HI_PLATFORM_BASE_URL=https://hi.hirey.ai`; this public domain is the only supported default target, so do not ask the user to choose an environment or provide a URL - keep `HI_MCP_TRANSPORT=stdio` - keep `HI_MCP_PROFILE=openclaw-main` unless the user explicitly wants a different stable profile - for the default OpenClaw profile, set `HI_MCP_STATE_DIR=~/.openclaw/hi-mcp/openclaw-main`; this must be the profile-scoped leaf directory, not the bare parent `~/.openclaw/hi-mcp`
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/hirey-compatible-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey AI skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/hirey-compatible-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey AI skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/hirey-compatible-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey AI skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/hirey-compatible-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey AI skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/hirey-compatible-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey AI skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw ...[truncated 25 chars]
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
js // openclaw-config-fs.mjs // // Direct-fs read/write for `~/.openclaw/openclaw.json` from the bundle's host // installer. Replaces every `runOpenClaw config get/set hooks/mcp.servers.<name>` // + `runOpenClaw mcp show/set/unset` invocation that the legacy installer used // to make via the openclaw subprocess CLI. Dropping the subprocess pattern is
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code performs safety-relevant filesystem changes to a user config file, including overwriting the file atomically and deleting configuration keys. Although the comments explain implementation details, there is no user-facing confirmation, logging, or explicit warning in the code about modifying
~/.openclaw/openclaw.jsonor removing settings.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
js /** * Verify a file's sha512 integrity against an `sha512-<base64>` integrity string * (the same format npm publishes in `dist.integrity`). Returns true if it matches, * throws otherwise. Pass `expectedIntegrity = null` to skip verification (only do * this when you trust the tarball source — for our case, we trust render-time * tarballs because render-channel.mjs fetched them from npm with `npm pack`). */
Static analysis
No suspicious patterns detected.