hirey
Hirey Hi as a native OpenClaw plugin: registers Hi tools, the agent-events claim service, and webhook ingress directly inside the gateway process — zero independent daemons, no `mcp.servers.hi` indirection, no per-run frozen tool inventory boundary. Same business logic as @hirey/hi-mcp-server / @hirey/hi-agent-receiver, but wired through OpenClaw's native register(api) instead of stdio MCP + spawned daemon. For OpenClaw 5.4+ via ClawPack `clawhub:hirey`; for OpenClaw 5.2 ~ 5.3 via npm fallback `openclaw plugins install npm:@hirey-ai/hirey` (same plugin code, ClawPack metadata path is broken on 5.2 ~ 5.3 ClawHub clients so we ship the same tarball through npm under the brand-name `@hirey-ai/hirey` for prod / `@hirey/hirey` for early — npm `hirey` (unscoped) was rejected by npm typosquatting policy). OpenClaw 4.23 ~ 5.1 must use the prod ClawHub bundle `clawhub:hirey-compatible` because their runtime expects date-format `compat.pluginApi` and rejects newer ranges.
Security Findings
4Recently created account
SuspiciousLineageAccount was 0d old when repo was created
No license file
SuspiciousLineageNo license file at the repo root and GitHub's licenseInfo is empty — code's legal status is unclear
No tagged releases
SuspiciousLineageRepo ships no git tags and no GitHub releases — consumers cannot pin to stable, reviewable versions
Package registry name mismatch
SuspiciousLineagenpm name 'hirey' != repo 'hi-openclaw-plugin'
Contents
1 skill bundled by this extension
hi-register
skill
Editions
3- 1.0.74Scanned Sep 4, 2026, 08:03 PMLow
- 1.0.73Scanned Aug 4, 2026, 03:33 PMLow
- 1.0.71Scanned Jul 13, 2026, 11:00 AMLow