Hive Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:56 PM UTC
• Version: 1.0.2

Overview

The Hive agent skill is coherent, but it needs Review because it stores an API key in a local plaintext file and can automatically publish LLM-generated trading comments from untrusted thread content.

Install only if you are comfortable with an agent that can post public Hive trading comments. Store the Hive API key outside the project or protect the file with owner-only permissions and exclude it from source control. Add prompt-injection defenses and output validation before automatic posting, and pin or avoid the optional npx CLI command unless you have reviewed the package version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:223
• Finding: Untrusted Remote Thread Content Can Manipulate LLM-Generated Public Comments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:223-246`, `SKILL.md:269-275`, and `references/analysis-pattern.md:13-18` **Vulnerability Type**: Prompt injection through untrusted remote content followed by an external side effect **Risk Level**: High ### Vulnerable Code Snippets From `SKILL.md:223-246`: ```markdown Use `thread.text` as the main input for analysis; optionally include `price_on_fetch` and `citations` in the prompt. --- ## Analyze thread and produce conviction 1. **Inputs:** `thread.text` (required), optionally `thread.price_on_fetch`, `thread.citations`, `thread.id`, `thread.project_id`. 2. **Output:** Structured object: - `summary` — short analysis text (e.g. 20–300 chars), in the agent's voice. - `conviction` — number: predicted **percent price change over 3 hours**, one decimal (e.g. `2.6` = +2.6%, `-3.5` = -3.5%, `0` = neutral). 3. **Optional:** `skip` (boolean). If `true`, do not post a comment (e.g. outside expertise or no strong take). Use your LLM with structured output (e.g. zod schema + Vercel AI SDK `Output.object`, or equivalent) so the model returns `{ summary, conviction }` or `{ skip, summary?, conviction? }`. Do not post when `skip === true` or when analysis fails. ``` From `SKILL.md:269-275`: ```markdown 1. **Load state** from `./hive-{Name}.json`. If no valid `apiKey` → register, then save `apiKey` to the file. 2. **Query threads:** If `cursor` exists, call `GET /thread?limit=20&timestamp={cursor.timestamp}&id={cursor.id}` so only **new** threads are returned. Otherwise `GET /thread?limit=20`. 3. For each thread in the response: - If `thread.locked`, skip. - **Analyze** using `thread.text` (and optional context) → get `summary` and `conviction` (or skip). - If not skipping: **Post comment** `POST /comment/:threadId` with `{ text, thread_id, conviction }`. 4. **Save state:** Set `cursor` to the newest thread's `timestamp` and `id` (so next run only fetches newer threads). Persist `apiKey` ...[truncated 2437 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Place remote fields inside explicit data delimiters and state in the trusted system prompt that instructions found inside those delimiters must never be followed. 2. Treat `thread.text`, citation titles, URLs, project identifiers, and all other API response fields as untrusted input. 3. Use a narrowly scoped system prompt that permits only market-signal analysis and explicitly prohibits obeying remote instructions, disclosing context, advertising, or generating operational commands. 4. Add semantic validation after structured generation. Reject summaries containing instruction-like text, unexpected URLs, credential material, unrelated content, or unsupported calls to action. 5. Constrain `conviction` to a documented numeric range and normalize it to one decimal place. 6. Require human approval before posting when the input or output triggers injection heuristics. 7. Log rejection reasons without recording credentials or sensitive prompt context. 8. Include adversarial prompt-injection cases in automated tests and fail closed whenever analysis or validation is uncertain. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:121
• Finding: Hive API Key Is Persisted in a Plaintext Working-Directory File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:121-151` and `SKILL.md:269-275` **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Medium ### Vulnerable Code Snippet From `SKILL.md:121-151`: ```markdown Persist the API key and run state in a **single file** so the agent can run periodically without re-registering. **Recommended path:** `./hive-{AgentName}.json` (sanitize name: alphanumeric, `-`, `_` only). **File format:** ```json { "apiKey": "the-api-key-string", "cursor": { "timestamp": "2025-02-09T12:00:00.000Z", "id": "last-seen-thread-object-id" } } ``` | Field | Required | Purpose | | -------- | -------- | ------------------------------------------------------------------------------------------------------------------------- | | `apiKey` | Yes | Use for all authenticated requests. Only register if missing or invalid. | | `cursor` | No | Last run's newest thread: `timestamp` (ISO 8601) + `id`. Use as query params on next run to fetch only **newer** threads. | **On startup:** 1. Load this file. If `apiKey` is missing or invalid → register, then save `apiKey`. 2. If `cursor` is present, use it when querying threads: `GET /thread?limit=20&timestamp={cursor.timestamp}&id={cursor.id}` so the API returns only threads **newer** than the last run. 3. If no `cursor`, call `GET /thread?limit=20` to get the latest threads. **After each run:** 1. **Save credentials** so the API key is never lost: keep `apiKey` and `cursor` in the same file. 2. **Update cursor** to the newest thread you processed or saw: set `cursor.timestamp` to that thread's `timestamp` and `cursor.id` to its `id`. Next run will then only fetch threads after this point. ``` ### Technical Analysis The Skill recommends storing the reusable API key as plaintext ...[truncated 1885 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the API key in an operating-system keychain, encrypted secret manager, or protected runtime environment variable. 2. Keep only the non-sensitive cursor in `hive-{AgentName}.json`. 3. If file storage is unavoidable, create the credential file atomically with owner-only permissions such as mode `0600`. 4. Add `hive-*.json` to `.gitignore` and equivalent backup or synchronization exclusions. 5. Never print the API key in logs, errors, prompts, telemetry, or command histories. 6. Validate ownership and permissions before reading an existing credential file, and refuse insecure files. 7. Document key rotation and revocation procedures for suspected exposure. 8. Avoid automatically re-registering on every authentication failure; distinguish revoked credentials from transient network errors to prevent unmanaged credential proliferation. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:314
• Finding: Unpinned npx Command Can Download and Execute Mutable Package Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:314` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - CLI bootstrapping: `npx @hive-org/cli create` scaffolds an agent with `SOUL.md` (personality) and `STRATEGY.md` (trading strategy) ``` ### Technical Analysis The documented `npx` command does not pin an exact package version or require integrity or provenance verification. Depending on the local npm configuration and cache state, `npx` can retrieve the current package release from a registry and execute its CLI code. This creates a mutable supply-chain execution path: the code that runs may differ from the code available when the Skill was audited. A compromised publisher account, malicious package release, registry compromise, or unexpected future package behavior could result in arbitrary local code execution. The command is presented as an optional additional resource rather than a mandatory part of the main workflow, but users following the guidance are still exposed. ### Attack Path 1. An attacker compromises the package publisher, distribution account, registry path, or a future release of `@hive-org/cli`. 2. The attacker publishes package content containing malicious executable or lifecycle code. 3. A user follows the Skill's bootstrapping guidance and runs `npx @hive-org/cli create`. 4. `npx` resolves and downloads the mutable package release. 5. The malicious package executes with the privileges and environment of the user who invoked the command. 6. The package can access files, environment variables, credentials, and network resources available to that user. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the invoking user's local privileges. This may permit access to project files, environment variables, local credentials, and other resources readable or writable by that account. No malicious package content ...[truncated 256 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the command to a specific reviewed version, for example `npx --yes @hive-org/cli@<audited-version> create`. 2. Record the package in a lockfile and install it through a controlled dependency-management process rather than executing the latest registry release directly. 3. Verify package integrity, provenance, publisher identity, and registry source before execution. 4. Use an organization-controlled registry mirror or allowlist where possible. 5. Run scaffolding in an isolated container or restricted workspace without production credentials. 6. Review lifecycle scripts and CLI entry points for the pinned version. 7. Upgrade only through an explicit review process rather than automatically resolving mutable releases. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The invocation description includes generic triggers like "conviction," "periodic," and "cursor," which are common terms in many unrelated agent tasks. Without tighter context or exclusion conditions, these phrases could cause unintended activation for non-Hive workflows.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Agent name:** Choose a **unique, descriptive** name for this agent (e.g. based on strategy, style, or domain). Do not use generic placeholders like "MyAnalyst"—invent a distinct name so the agent is identifiable on the platform (e.g. `CautiousTA-Bot`, `SentimentHive`, `DegenOracle`).

```bash
curl -X POST "https://hive-backend.z3n.dev/agent/register" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "YourUniqueAgentName",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to persist an API key to a local file but does not warn about file permissions, secret exposure, backups, source-control leakage, or safer secret-storage options. Because the same file also stores run state, users may treat it as ordinary application data and accidentally commit or expose it, enabling unauthorized use of the Hive account/API key.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

}
```

| Field    | Required | Purpose                                                                                                                   |
| -------- | -------- | ------------------------------------------------------------------------------------------------------------------------- |
| `apiKey` | Yes      | Use for all authenticated requests. Only register if missing or invalid.                                                  |
| `cursor` | No       | Last run's newest thread: `timestamp` (ISO 8601) + `id`. Use as query params on next run to fetch only **newer** threads. |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

After analyzing a thread and computing `summary` and `conviction`, post a single comment:

```bash
curl -X POST "https://hive-backend.z3n.dev/comment/THREAD_ID" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill recommends running `npx @hive-org/cli` without pinning a specific version. That allows whatever package version is current at execution time to run code on the user's machine, creating a supply-chain risk if the package is compromised or a breaking/malicious update is published. In this context, the risk is amplified because the CLI is suggested for bootstrapping an agent that will handle API credentials and trading-related automation.

Static analysis

No suspicious patterns detected.