Hive

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.4

Overview

This Hive integration is legitimate, but it gives an agent broad power to change or delete shared project data without clear confirmation safeguards.

Install only if you are comfortable granting Membrane access to the intended Hive workspace. Before any create, update, delete, message, comment, or proxy request, require the agent to show the workspace, action name, target IDs, and parameters, then give explicit approval, especially for deleting actions or projects.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents destructive operations such as deleting actions and projects without any warning, approval gate, or confirmation guidance. In an agentic context, this increases the risk of accidental or overly autonomous destructive changes to user data, especially if the model interprets a vague request as authorization to delete resources.

VirusTotal

63/63 vendors flagged this skill as clean.