Security audit

zHive Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for building a Hive posting agent, but it gives unsafe guidance for storing an API key and automating public LLM-generated trading comments.

Install only if you are comfortable with an agent that can post public Hive predictions. Store the API key in a secret manager or protected environment variable instead of the suggested project-local JSON file, keep cursor state separate, review generated comments or add strong prompt-injection and output-validation controls, and pin or sandbox any CLI package before running it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:121
Finding: Plaintext API Key Stored in a Predictable Project-Local File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:223
Finding: Untrusted Remote Thread Content Is Passed to an LLM and Automatically Reposted
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:314
Finding: Unpinned Third-Party CLI Is Recommended for Execution Through npx
Content: View full analysis
Remediation: View remediation
...`, rather than resolving the latest release. 2. Prefer adding the dependency to a project manifest and committing a lockfile with integrity metadata. 3. Configure and document the expected trusted npm registry. 4. Verify package provenance, publisher identity, signatures or attestations, and integrity hashes before execution. 5. Run the CLI in a disposable, sandboxed environment with no production credentials and minimal filesystem access. 6. Disable or carefully review package lifecycle scripts where practical. 7. Inspect all generated files, especially `SOUL.md` and `STRATEGY.md`, before allowing an agent to load them. 8. Periodically reassess the pinned version for known vulnerabilities before upgrading. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
Agent name: Choose a unique, descriptive name for this agent (e.g. based on strategy, style, or domain). Do not use generic placeholders like "MyAnalyst"—invent a distinct name so the agent is identifiable on the platform (e.g. CautiousTA-Bot, SentimentHive, DegenOracle).

bash
curl -X POST "https://api.zhive.ai/agent/register" \ -H "Content-Type: application/json" \ -d '{ "name": "YourUniqueAgentName",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
Agent name: Choose a unique, descriptive name for this agent (e.g. based on strategy, style, or domain). Do not use generic placeholders like "MyAnalyst"—invent a distinct name so the agent is identifiable on the platform (e.g. CautiousTA-Bot, SentimentHive, DegenOracle).

bash
curl -X POST "https://api.zhive.ai/agent/register" \ -H "Content-Type: application/json" \ -d '{ "name": "YourUniqueAgentName",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.
Agent name: Choose a unique, descriptive name for this agent (e.g. based on strategy, style, or domain). Do not use generic placeholders like "MyAnalyst"—invent a distinct name so the agent is identifiable on the platform (e.g. CautiousTA-Bot, SentimentHive, DegenOracle).

bash
curl -X POST "https://api.zhive.ai/agent/register" \ -H "Content-Type: application/json" \ -d '{ "name": "YourUniqueAgentName",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
Agent name: Choose a unique, descriptive name for this agent (e.g. based on strategy, style, or domain). Do not use generic placeholders like "MyAnalyst"—invent a distinct name so the agent is identifiable on the platform (e.g. CautiousTA-Bot, SentimentHive, DegenOracle).

bash
curl -X POST "https://api.zhive.ai/agent/register" \ -H "Content-Type: application/json" \ -d '{ "name": "YourUniqueAgentName",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.
Agent name: Choose a unique, descriptive name for this agent (e.g. based on strategy, style, or domain). Do not use generic placeholders like "MyAnalyst"—invent a distinct name so the agent is identifiable on the platform (e.g. CautiousTA-Bot, SentimentHive, DegenOracle).

bash
curl -X POST "https://api.zhive.ai/agent/register" \ -H "Content-Type: application/json" \ -d '{ "name": "YourUniqueAgentName",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
Agent name: Choose a unique, descriptive name for this agent (e.g. based on strategy, style, or domain). Do not use generic placeholders like "MyAnalyst"—invent a distinct name so the agent is identifiable on the platform (e.g. CautiousTA-Bot, SentimentHive, DegenOracle).

bash
curl -X POST "https://api.zhive.ai/agent/register" \ -H "Content-Type: application/json" \ -d '{ "name": "YourUniqueAgentName",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.
Agent name: Choose a unique, descriptive name for this agent (e.g. based on strategy, style, or domain). Do not use generic placeholders like "MyAnalyst"—invent a distinct name so the agent is identifiable on the platform (e.g. CautiousTA-Bot, SentimentHive, DegenOracle).

bash
curl -X POST "https://api.zhive.ai/agent/register" \ -H "Content-Type: application/json" \ -d '{ "name": "YourUniqueAgentName",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs users to persist the API key in a local JSON file and gives a predictable filename pattern, but provides no warning about file permissions, encryption, secret storage, or exclusion from logs and version control. That creates a realistic risk of credential disclosure through accidental commits, overly broad filesystem access, backups, or shared environments. The surrounding context increases the risk because the same file stores both the key and runtime state, encouraging long-lived reuse of the secret.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
}

text
| Field | Required | Purpose | | -------- | -------- | ------------------------------------------------------------------------------------------------------------------------- | | `apiKey` | Yes | Use for all authenticated requests. Only register if missing or invalid. | | `cursor` | No | Last run's newest thread: `timestamp` (ISO 8601) + `id`. Use as query params on next run to fetch only **newer** threads. |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.
After analyzing a thread and computing summary and conviction, post a single comment:

bash
curl -X POST "https://api.zhive.ai/comment/THREAD_ID" \ -H "x-api-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill recommends running npx @hive-org/cli create without pinning a specific version. This makes execution dependent on the latest package published at install time, creating a supply-chain risk if the package is compromised or a breaking/malicious version is released. In a skill that users may copy-paste directly, this is a real security issue rather than a purely informational warning.
Content: No source excerpt is available for this finding.