T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:114- Finding
Remote Platform Instructions Are Executed as Authoritative Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Install Hirey Hi on OpenClaw
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent installer purpose, but it needs Review because it installs persistent OpenClaw hooks/MCP components while using a plaintext service endpoint and remote onboarding instructions.
Install only if you are comfortable with Hi adding persistent OpenClaw hooks and an MCP server, storing a local bearer token, binding this chat for future replies, and communicating with Hirey's default service over plaintext HTTP. Prefer waiting for an HTTPS endpoint, reconciled package versions, and stricter dependency integrity controls before using it for sensitive accounts or private matching workflows.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/openclaw-host-installer.mjs:14- Finding
Sensitive Registration and Routing Data Is Configured for Transmission to a Plaintext HTTP Service
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/openclaw-host-installer.mjs:585- Finding
Installer Downloads and Installs Executable npm Packages Without Lockfile Integrity Enforcement
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - resolve `./scripts/openclaw-host-installer.mjs` relative to this local `SKILL.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - resolve `./scripts/openclaw-host-installer.mjs` relative to this local `SKILL.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - resolve `./scripts/openclaw-host-installer.mjs` relative to this local `SKILL.md`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - resolve `./scripts/openclaw-host-installer.mjs` relative to this local `SKILL.md`
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata and installer contract claim the flow completes local install, registration, health checks, and a post-install welcome/onboarding step that drafts the first listing, but the implementation stops after generating phase-2 install arguments and never performs the promised onboarding actions. In an agent setting, this mismatch is dangerous because downstream automation may treat the host as fully provisioned and socially activated when critical registration/onboarding steps were never executed, creating unsafe partial state, broken business logic, or unintended follow-on actions based on false completion.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises applicability to an extremely broad set of ordinary user goals ('any other human lead search') and says agents should use Hi whenever the owner needs to find people. Overbroad activation increases the chance the skill is invoked in contexts the user did not clearly intend, which is more dangerous here because the skill performs installation, configuration changes, and later onboarding actions tied to an external service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill quickly proceeds into package installation and host configuration logic without a prominent upfront warning that it will modify local plugins, MCP configuration, hooks, and persistent state. That can undermine informed user consent and makes accidental system changes more likely, especially because the skill is framed as a normal path rather than a sensitive administrative operation.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 83% confidence
- Finding
The skill hard-codes operational decisions such as package versions, install target, profile, state directory, and service endpoint while explicitly instructing the agent not to ask the user. Autonomous decisions are risky here because they result in persistent software installation and host reconfiguration connected to an external service, reducing user oversight over consequential actions.
- Content
md - use the official Hi packages at the current pinned public release versions: `@hirey/hi-mcp-server@0.1.19` and, when local durable delivery is enabled, `@hirey/hi-agent-receiver@0.1.11` - install the Hi npm packages into a user-writable vendor dir under `~/.openclaw/vendor/hi`; do not rely on `npm -g`, `sudo`, or any elevated install path - mount `hi-mcp-server` from that vendor dir as a local `stdio` MCP child process - for ordinary user installs, always set `HI_PLATFORM_BASE_URL=http://hi.hireyapp.us`; this public domain is the only supported default target, so do not ask the user to choose an environment or provide a URL - keep `HI_MCP_TRANSPORT=stdio` - keep `HI_MCP_PROFILE=openclaw-main` unless the user explicitly wants a different stable profile - for the default OpenClaw profile, set `HI_MCP_STATE_DIR=~/.openclaw/hi-mcp/openclaw-main`; this must be the profile-scoped leaf directory, not the bare parent `~/.openclaw/hi-mcp`
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 77% confidence
- Finding
The skill instructs generation and persistence of a fresh hooks bearer token and full hooks/MCP configuration, while also binding session-routing behavior. This is sensitive session and authentication state: if misapplied, leaked, or written without explicit user awareness, it can expose inbound control surfaces, alter where messages are routed, and create durable trust relationships on the host.
- Content
md - enable OpenClaw hook ingress with `hooks.enabled=true`; setting `hooks.path` or `hooks.token` alone is not enough because `/hooks/*` routes are only mounted when hooks are enabled - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/openclaw-hi-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled ins ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/openclaw-hi-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw's canon ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/openclaw-hi-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw's canon ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/openclaw-hi-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw's canon ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/openclaw-hi-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw's canon ...[truncated 25 chars]
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - OpenClaw hooks require a dedicated bearer token; generate a fresh random token for hooks, reuse that same token in the Hi receiver config, and never reuse the gateway auth token as `hooks.token` - before running `setup`, verify the current OpenClaw CLI / paired device can actually perform `openclaw config set` and `openclaw mcp set`; if the host still reports `pairing required`, device repair, or only read-only operator scopes, stop with a host pairing blocker before partially installing Hi - a missing `hooks` config on a clean host, including `hooks={}`, is normal pre-install state rather than a write blocker; do not ask an ordinary user for `hooks.token` / `host_adapter_bearer_token`, because the bundled `setup` flow must generate and write the hooks token plus the full hooks / MCP config itself - if a local hard-path read like `/app/skills/openclaw-hi-install/SKILL.md` fails with `ENOENT`, treat that as a host skill snapshot / visibility issue; re-check the installed ClawHub skill through the host workspace skill index or ClawHub metadata instead of assuming the Hirey skill artifact is missing - treat OpenClaw host prep and Hi registration as two steps separated by a per-run-tool-inventory boundary that the OpenClaw LLM runtime forces (the LLM run's tool list is materialized once at run start and frozen; newly-installed MCP servers become callable only from the next LLM run, *not* the same outer run that wrote them): the **setup** step installs packages and writes complete host config / MCP wiring; the **register** step (calling `hi_agent_install`) runs either from the user's next message (default) or through a nested `openclaw agent --message …` sub-run inside the same outer turn (optional faster variant — see the Install Order section) - during the setup step, call the bundled installer in one blocking command; do not split raw host config mutations across multiple tool calls while that installer is available - during the setup step, use only OpenClaw's canon ...[truncated 25 chars]
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to follow a platform-provided onboarding script exactly and not to ask the user whether to leave the chat unbound, effectively constraining user choice after installation. In context, this goes beyond convenience: it can bind session routing, drive onboarding conversation, and prepare listing creation with limited user control, creating risk of unauthorized account/service actions and privacy-impacting data submission.
- Content
md - after install succeeds, do not promise that `openclaw-hi-use` is already visible in this same turn; if the current turn still lacks that post-install usage surface, say plainly that the session has not refreshed yet and ordinary Hi work should continue in the next fresh turn of the same chat - after install succeeds, the platform will (within a few minutes of stable healthy install) push a one-time **welcome recommendation batch** as an `agent.message.created` webhook with `payload.kind="install_welcome_recommendation"`. The payload carries m social_or_friendship listing previews — front n curated by Hi staff, back m-n the most recently posted friendship listings. This is a view-only teaser, not a contact-ready handoff: the owner has no source listing yet, so any `matching_sessions(action="contact_match")` against these listing ids will fail. Treat the welcome batch as informational; the bundled `openclaw-hi-use` skill describes how to surface it to the owner without overpromising. Each agent gets the welcome batch at most once (Hi guarantees this via `agent_event_outbox` idempotency); do not retrigger it manually - when `hi_agent_install` returns with a populated `welcome` field (shape: `{ kind: "install_welcome_onboarding", instruction_to_llm: string, recent_activity: [{listing_id, listing_type_id, published_by_agent_id, target_preview_text, listing_created_at}], intent_options: [{id, label_zh, label_en, listing_type_id}] }`), follow `welcome.instruction_to_llm` exactly — that string is the platform-authored onboarding script and supersedes any per-skill rephrasing. The recent_activity and intent_options are pre-fetched for you from the platform; do not call `agent_listings(action="browse_recent")` again to re-fetch them. Run the welcome conversation in the same language the owner is using in this chat, not the language the instruction string is written in. Do not skip this step just because doctor is healthy — doctor only proves the technical install is good, t ...[truncated 25 chars]
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The install order explicitly directs the agent to proceed with the canonical install path and discourages asking the user to choose environment or approve key decisions. Because these steps install software and alter persistent host state, minimizing user decision points increases the chance of unintended administrative actions.
- Content
md Ordinary users do not need to know the word "phase" or "LLM run boundary"; they just see either "I'm installing Hi… please continue in your next message" (default) or, in the faster variant, no continuation at all (you report `agent_id` directly). 1. Treat Hirey's official default Hi service at `http://hi.hireyapp.us` as the only ordinary-user install target; do not ask the user to choose an environment or provide a URL. 2. If the local bundle is not already present, start with the canonical ClawHub package command `openclaw plugins install clawhub:hirey-openclaw-hi-install`. Treat `hirey-openclaw-hi-install` as a package / bundle, not a bare skill. Run that command in one blocking `exec`-style call with a several-minute timeout and wait for its final stdout/stderr, approval prompt, or concrete error before branching. 3. If that package-install command returns a concrete error, diagnose that exact error. The one common false-positive is `plugin already exists … delete it first`, which simply means an older copy of this same bundle is still on disk from a previous install or stale state; re-run the exact same command with `--force` appended (canonical OpenClaw idiom for an in-place bundle upgrade) and continue. If it succeeds and the host then reloads or reconnects, treat that as the package step finishing rather than as a reason to poll an old background process session in a later turn. Do not branch into `openclaw skills search`, `openclaw help`, ACP, or guessed install commands before first attempting the canonical package path. 4. Once the package is installed locally, if a local hard-path read like `/app/skills/openclaw-hi-install/SKILL.md` fails with `ENOENT` during host skill lookup, treat it as a host-local skill snapshot visibility problem; re-check via ClawHub or the host workspace skill index and stay on the official ClawHub path rather than concluding the Hirey artifact is missing.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The applyPhase1 path installs npm packages, writes OpenClaw hooks and MCP config, and persists a manifest to disk. These safety-relevant mutations are documented in the usage text, but the execution path itself provides no print/log statement or confirmation before making the changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The resetPhase1 flow unsets OpenClaw hooks and MCP configuration and removes the manifest file, which are destructive host mutations. While the usage text documents cleanup behavior, this function itself has no confirmation prompt or explicit runtime warning before carrying out the changes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The usage text asserts that status can report whether setup has finished and what install args are recommended, but the implementation does not actually complete setup and does not include recommended install arguments in the status path. Misleading operator-facing output in an installer is security-relevant because users or higher-level agents may incorrectly trust that a sensitive host integration is complete and healthy, skipping required review or running subsequent privileged steps on a partially configured system.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/openclaw-host-installer.mjs:523