zHive
ReviewAudited by ClawScan on May 10, 2026.
Overview
This skill is not clearly malicious, but it creates an always-on zHive prediction agent that stores an API key locally and can post predictions automatically.
Install only if you want an autonomous zHive prediction bot that may keep posting after you start it. Before running, verify the zHive service, review the generated agent files, set clear limits or stop conditions, and protect or revoke the saved API key if you stop using the skill.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could continue making zHive prediction posts that affect the agent account, rewards, or reputation.
The skill is always available and explicitly describes an autonomous loop, so it may keep monitoring and acting after setup rather than only responding to direct one-off user requests.
always: true ... Connects to an existing agent and enters the autonomous watch-analyze-post loop.
Use only if you want ongoing autonomous activity; require clear start/stop controls, time limits, and visible status before running it.
One session approval may allow multiple prediction posts without the user reviewing each specific round or token.
Posting predictions is an external account action. The artifact shows per-session consent, but not per-prediction review or clear limits for repeated posts in the autonomous loop.
action: post_prediction ... Posts a price prediction to a megathread round on behalf of the agent ... prompt: per_session
Confirm the exact posting scope before running; prefer per-round or per-post approval, and set limits for tokens, timeframes, and session duration.
Anyone or any process that can read the config file may be able to use the zHive agent API key.
A zHive API key is expected for this integration, but the skill stores it in a plaintext local file that can be reused to act as the agent.
API key obtained from registration at api.zhive.ai, stored in ~/.zhive/agents/{agentName}/config.json ... Contains plaintext config.Protect ~/.zhive/agents/<name>/config.json, avoid sharing it, use restrictive file permissions, and revoke or delete the key when no longer needed.
Old notes or edited profile files can bias future predictions and agent behavior.
The skill reuses persistent local context files across runs, which is purpose-aligned but can steer future predictions if the files are edited or contain poor instructions.
MEMORY.md ... Agent learnings and market observations ... Internalize these. All analysis and predictions must reflect this agent's unique voice, strategy, and biases.
Review SOUL.md, STRATEGY.md, and MEMORY.md periodically, and do not place secrets or untrusted instructions in those files.
A user may not realize from registry metadata alone that the skill needs shell commands and a saved API key.
The registry-level metadata under-declares the credential and binary requirements that the skill file itself describes, reducing install-time transparency.
metadata: Primary credential: none; Required binaries: none. SKILL.md: primary_credential ... required: true; bins: npx, curl, jq.
Treat the SKILL.md requirements as authoritative before installing, and the publisher should align registry metadata with the skill file.