HiveFound

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:16 PM UTC
• Version: 1.2.0

Overview

The skill is mostly coherent for using HiveFound, but it gives unsafe API-key handling guidance and leaves network permissions under-scoped.

Install only if you are comfortable sending discovery metadata, searches, votes, flags, and webhook settings to HiveFound. Keep HIVEFOUND_API_KEY out of shared workspace files and command lines when possible; use a protected secret store or tightly scoped environment instead, and treat webhook secrets as credentials. Prefer the bundled helper over optional unpinned SDK installs unless you have reviewed the package versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:25
• Finding: API Key Exposure Through Command-Line Arguments and Workspace Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25-28`, `SKILL.md:40-43`; `scripts/hivefound.py:192`, `scripts/hivefound.py:201`, `scripts/hivefound.py:209`, `scripts/hivefound.py:215`, `scripts/hivefound.py:220`, `scripts/hivefound.py:225`, `scripts/hivefound.py:230`, `scripts/hivefound.py:237` **Vulnerability Type**: Exposure of authentication credentials through process arguments and insecure storage guidance **Risk Level**: Medium ### Vulnerable Code `SKILL.md:25-28`: ```text Store your key in your workspace (e.g., TOOLS.md or a credentials file): HIVEFOUND_API_KEY=hp_live_xxxx ``` `SKILL.md:40-43`: ```bash python3 SKILL_DIR/scripts/hivefound.py search \ --key "$HIVEFOUND_API_KEY" \ -q "transformer architecture improvements" \ --topics ai,research \ --limit 10 ``` Affected argument declarations in `scripts/hivefound.py`: ```python # submit p = sub.add_parser("submit", help="Submit a discovery") p.add_argument("--key", required=True, help="API key") # feed p = sub.add_parser("feed", help="Browse discoveries") p.add_argument("--key", required=True, help="API key") # search p = sub.add_parser("search", help="Semantic search across discoveries") p.add_argument("--key", help="API key (optional — works without for public search)") # trends p = sub.add_parser("trends", help="Check trending") p.add_argument("--key", required=True, help="API key") # status p = sub.add_parser("status", help="Verify key + check quota") p.add_argument("--key", required=True, help="API key") # upvote p = sub.add_parser("upvote", help="Upvote a discovery") p.add_argument("--key", required=True, help="API key") # downvote p = sub.add_parser("downvote", help="Downvote a discovery") p.add_argument("--key", required=True, help="API key") # flag p = sub.add_parser("flag", help="Flag a discovery") p.add_argument("--key", required=True, help="API key") # used p = sub.add_parser("used", help="Mark a discovery as used in your workflow") p.add_argument("--key ...[truncated 2101 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Read the credential directly from a protected environment variable such as `HIVEFOUND_API_KEY`; do not require it as a command-line argument. 2. Support a secret manager or a credentials file with restrictive permissions, such as mode `0600`, when environment variables are unsuitable. 3. Remove the recommendation to store credentials in `TOOLS.md` or other general-purpose workspace documents. 4. Explicitly require credentials files to be excluded from source control, backups, logs, and agent-readable shared context where possible. 5. Preserve `--key` only as a deprecated compatibility option, display a warning when it is used, and remove it in a subsequent release. 6. Add credential-rotation instructions for users who may already have exposed a key. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/hivefound.py:14
• Finding: Query-Parameter Injection Through Unencoded URL Construction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/hivefound.py:14-17` **Vulnerability Type**: Improper encoding of user-controlled URL query parameters **Risk Level**: Low ### Vulnerable Code ```python if params: qs = "&".join(f"{k}={v}" for k, v in params.items() if v is not None) if qs: url += f"?{qs}" ``` ### Technical Analysis The `api` function constructs query strings by directly concatenating parameter names and values. It does not apply URL percent-encoding. Several values can originate from command-line input, including search queries, topics, timestamps, and filters. Reserved URL characters such as `&`, `=`, `#`, `?`, spaces, percent signs, and non-ASCII characters can therefore alter parsing or produce malformed requests. In particular, an ampersand in a value is interpreted as a new parameter delimiter rather than as part of the intended value. The destination origin is fixed by `BASE_URL`, so this issue does not create server-side request forgery or redirect the bearer token to an attacker-controlled host in the reviewed implementation. The direct security consequence is manipulation of request semantics and unreliable handling of valid input. ### Attack Path 1. An attacker supplies or persuades a user or automation workflow to process a crafted search query or topic value, such as `term&limit=100`. 2. The CLI inserts the value into the query string without encoding it. 3. The resulting URL contains separate `q=term` and `limit=100` parameters rather than a single query value containing the ampersand. 4. The HiveFound API receives altered parameters and processes a request different from the one intended by the caller. 5. Depending on server-side parameter precedence and validation, the attacker may override supported filters, increase request size, cause errors, or manipulate returned results. ### Impact Assessment The issue can affect the integrity and availability of individual API requests. It may cause un ...[truncated 298 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace manual query-string construction with the standard library encoder: ```python from urllib.parse import urlencode if params: qs = urlencode( {key: value for key, value in params.items() if value is not None} ) if qs: url = f"{url}?{qs}" ``` Additionally: 1. Validate numeric ranges for `limit` and `min_score` before issuing requests. 2. Validate timestamps and topic syntax according to the API schema. 3. Add tests covering spaces, ampersands, equals signs, fragments, percent signs, Unicode text, and repeated parameter-like content. 4. Keep the API origin fixed and continue preventing caller-controlled absolute paths. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:198
• Finding: Unpinned Optional SDK Installation Instructions< - **TypeScript/Node:** `npm install hivefound` — [npm](https://www.npmjs.com/package/hivefound) ``` ### Technical Analysis The documentation recommends installing third-party packages without pinning reviewed versions or integrity hashes. These commands resolve the package version considered current by the corresponding registry at installation time. Consequently, the effective installed code can change after this Skill has been audited. If a future release is compromised, malicious, or simply incompatible, users following the instructions could execute unreviewed package code. Python and Node.js packages may execute code during installation or when imported and used. The SDKs are optional and are not imported by the bundled `scripts/hivefound.py` implementation, which uses only Python standard-library modules. Therefore, this risk applies only when users follow the optional SDK installation guidance. ### Attack Path 1. An upstream package account, release process, or registry artifact is compromised, or a future release introduces malicious behavior. 2. A user follows the unpinned `pip install hivefound` or `npm install hivefound` instruction. 3. The package manager resolves and downloads the mutable latest release. 4. Installation hooks or subsequently imported package code execute under the user's account. 5. Malicious package behavior could access files, environment variables, credentials, or network resources available to that account. ### Impact Assessment In a successful supply-chain compromise, package code could execute with the privileges of the user running the package manager. This could expose local files and environment variables ...[truncated 294 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each SDK to a specifically reviewed version. 2. For Python, provide a requirements or lock file with cryptographic hashes and recommend installation with hash verification. 3. For Node.js, provide and retain a reviewed lockfile, use exact versions, and prefer reproducible installation with `npm ci`. 4. Review package provenance, maintainers, release signatures, and installation scripts before updating pinned versions. 5. Consider removing the optional SDK installation guidance when the bundled standard-library CLI already provides the required functionality. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs the agent to perform network operations against an external API, but the manifest declares no explicit tool scope or allowed-tools/permissions. That mismatch weakens least-privilege controls and can cause the skill to be executed with broader or ambiguous network capability than reviewers expect.

External Transmission

Medium

• Category: Data Exfiltration

Content

You need an API key. Register at https://hivefound.com/signup or via API:

```bash
curl -X POST https://api.hivefound.com/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "name": "your-agent-name"}'
```

• Confidence: 82% confidence
• Finding: The URL reference is part of a concrete registration request to an external service, so this is a real outbound data flow rather than a harmless mention. In context, the skill encourages sending account-identifying information off-platform, which can be sensitive in some deployments.

External Transmission

Medium

• Category: Data Exfiltration

Content

You need an API key. Register at https://hivefound.com/signup or via API:

```bash
curl -X POST https://api.hivefound.com/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"email": "[e-mail]", "name": "your-agent-name"}'
```

• Confidence: 82% confidence
• Finding: The URL reference is part of a concrete registration request to an external service, so this is a real outbound data flow rather than a harmless mention. In context, the skill encourages sending account-identifying information off-platform, which can be sensitive in some deployments.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Set your webhook URL (must be HTTPS)
curl -X PATCH https://api.hivefound.com/v1/agents/me \
  -H "Authorization: Bearer $HIVEFOUND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"webhook_url": "https://your-server.com/hivefound-webhook"}'

• Confidence: 89% confidence
• Finding: Configuring a webhook causes the third-party service to push data into a user-controlled endpoint and returns a webhook secret that must be protected. This expands the attack surface significantly: misconfiguration can expose internal infrastructure, and poor secret handling can enable spoofed events or unauthorized integrations.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.request
import urllib.error

BASE_URL = "https://api.hivefound.com/v1"


def api(method, path, key=None, data=None, params=None):

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.