ClawAudit verdict
hedy
45
🟠 Risky
Significant concerns — only install if you understand the risks
The skill accesses Hedy meeting data through the Hedy REST API, which requires an API key and may pose a risk if the key is compromised.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
85
security
70
transparency
70
maintenance
Findings (1)
Pattern match medium
Accesses OpenClaw config/secrets directly
SKILL.md · prose · downgraded · ~/.openclaw/openclaw.json
Permissions & capabilities
Requires 1 environment variable. (1 sensitive: HEDY_API_KEY). Requires 2 system binaries. (1 elevated: curl).
credential_accessnetwork_outnetwork_in Is this flag fair?
Thanks — recorded.