T03 · Remote Payload Retrieval and Execution
Error
- Location
references/setup-and-platforms.md:33- Finding
Downloaded Installer Is Executed Without Cryptographic Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Hive CLI
Security checks for vulnerabilities and agentic risk
Overview
This Hive skill is mostly coherent, but it asks agents to rely on powerful local workflow tooling with broad execution permissions and weakly pinned installation paths.
Install only if you trust the Hive publisher, the Homebrew tap or installer source, and the Hive CLI's workflow permission model. Review generated workflows before running them, be cautious with Honeycomb workflow installs, and prefer explicit previews or narrower permissions for workflows that do not need unrestricted local execution.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:8- Finding
Automatically Installable CLI Dependency Is Sourced from an Unpinned Personal Homebrew Tap
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/workflow-permissions.md:3- Finding
Generated Agent Stages Default to Unrestricted Local Execution Permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/safety.md:30- Finding
Third-Party Honeycomb Workflows May Be Installed Without Explicit Permission Approval
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Read [workflow-creator.md](references/workflow-creator.md) when ordinary language asks to create a new project-local workflow. This focused route is the `hive
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Read [safety.md](references/safety.md) before any admin, force, credential, external-publication, deployment, or release-sensitive operation.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
text For Arch, display the selected transaction and ask the user to run it in their real terminal. Never add `--noconfirm` or execute the transaction through a non-TTY agent tool call. On supported Ubuntu or compatible glibc Linux, download the version-pinned
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description is extremely broad and covers many operational, diagnostic, workflow-creation, QA, recovery, and setup tasks. In agentic systems that auto-route by description, this can cause the skill to be invoked in situations beyond the user's intent, increasing the chance of unintended command execution or disclosure of sensitive operational state.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - `idle`: the task is ready for dispatch and has no current worker. - `unknown`: evidence is incomplete or contradictory; say what is missing. Do not reinterpret `idle` as “nothing is happening” without checking ownership and scheduler evidence. Do not attribute a provider wait unless the current snapshot names the provider or a current scheduler disposition proves it. ## Authority boundary
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phrase 'Help me answer the next question.' is ordinary conversational language, yet this transcript assigns it a control meaning that activates Guided answering behavior. In an agentic setting, such overlap can let unrelated user text or quoted content be misinterpreted as an operational command, causing the system to enter a workflow that targets live task data without sufficiently explicit intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger 'Answer everything you can justify.' authorizes broad automatic scanning and writing across multiple unanswered slots, which is a high-risk action to bind to a natural-language phrase. Because the scope is expansive and spans multiple tasks/questions, a mistaken or injected trigger could cause unintended bulk modifications to durable project state before the operator realizes automation has begun.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 89% confidence
- Finding
The line creates an exception that explicitly removes user confirmation for
hive workflow install honeycomb/NAME, even though the surrounding policy otherwise requires confirmations for operations with network/filesystem effects and installs. In an agent setting, this weakens human-in-the-loop safeguards and could allow an agent to autonomously install a package that changes local state or introduces risky code, especially if 'verified' is treated as sufficient trust without independent validation at decision time.- Content
md `hive module dry-run`, by contrast, is explicitly pure and read-only; it never persists a trigger or launches a hook. A verified `hive workflow install honeycomb/NAME` needs no confirmation. Hive discloses the package's network and filesystem access and proceeds. Agents must not insert a preview/approval/`--yes` loop in front of this ordinary install. Workflow update, remove, and publish keep their separate boundaries.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 65% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
text For Arch, display the selected transaction and ask the user to run it in their real terminal. Never add `--noconfirm` or execute the transaction through a non-TTY agent tool call. On supported Ubuntu or compatible glibc Linux, download the version-pinned
Static analysis
No suspicious patterns detected.