Hivulse蜂巢AI-Gen-Tech Docs 自动生成技术文档

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:00 AM UTC
• Version: 0.1.4

Overview

This skill has a coherent document-generation purpose, but it can broadly upload project files to a cloud service without enough scoping or review controls.

Review exactly which project directory you pass to this skill and assume most readable files under it may be uploaded to the hivulseAI cloud service. Do not run it on repositories containing .env files, private keys, credentials, customer data, or regulated information unless you have reviewed and removed those files first. Prefer a temporary sanitized copy of the project, and avoid storing the API key in the local plaintext config unless you accept that local exposure risk.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: hivulseAI.py:109
• Finding: Unrestricted Recursive Upload May Disclose Credentials and Private Files<![CDATA[ ## Vulnerability Details **File Location**: `hivulseAI.py:109-118` and `hivulseAI.py:133-140` **Vulnerability Type**: Insufficient file filtering before external transmission **Risk Level**: High ### Vulnerable Code ```python for root, dirs, files in os.walk(directory): # Filter excluded directories dirs[:] = [d for d in dirs if d not in self.exclude_dirs] for file in files: # Filter excluded file extensions if any(file.endswith(ext) for ext in self.exclude_extensions): continue file_path = os.path.join(root, file) file_paths.append(file_path) ``` The resulting files are subsequently uploaded: ```python with open(file_path, 'rb') as f: files = {'file': (os.path.basename(file_path), f)} data = {'file_path': api_file_path} if branch_id: data['branch_id'] = branch_id response = requests.post(url, files=files, data=data, headers=self.headers) ``` ### Technical Analysis The application recursively enumerates every file beneath the user-selected directory. Its denylist excludes only six directory names and two file extensions. It does not exclude common sensitive files such as: - `.env` and environment-specific secret files - SSH or signing keys - Cloud provider credentials - Certificates and private keys - Database backups or dumps - OpenClaw and MCP configuration files - Package-manager authentication files - Files containing access tokens The implementation also does not explicitly reject symbolic links. A file symlink located inside the selected project may therefore cause `open(file_path, 'rb')` to read a target outside the intended project tree. All collected content is transmitted to the third-party endpoint at `https://cloud.hivulse.com`. Although uploading project content is part of the declared functionality, uploading credentials, unrelated private files, or out-of-tree symlink targets exceeds the data required for document generation. ### Attack Path 1 ...[truncated 1111 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the broad denylist with an explicit allowlist of file extensions and file types required for technical-document generation. 2. Exclude common secret-bearing files and patterns, including `.env*`, `*.pem`, `*.key`, `*.p12`, credential files, authentication configuration, database dumps, and package-manager tokens. 3. Reject symbolic links with `Path.is_symlink()` or resolve each path and verify that it remains beneath the resolved project root. 4. Apply configurable per-file and aggregate upload-size limits. 5. Scan prospective uploads for likely secrets before transmission and block or redact detected values. 6. Present the complete upload manifest to the user and require explicit confirmation before sending files. 7. Document the external destination, retention policy, access controls, and deletion process. 8. Consider packaging and uploading only files explicitly selected by the user rather than recursively uploading the entire directory. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: hivulseai_skill.py:139
• Finding: Shell Command Injection Through an Unquoted Installation Path<![CDATA[ ## Vulnerability Details **File Location**: `hivulseai_skill.py:139-144` **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```python skill_dir = Path(__file__).parent interactive_path = skill_dir / "interactive.py" if interactive_path.exists(): os.system(f"python {interactive_path}") else: print("❌ Interactive module does not exist") ``` ### Technical Analysis `os.system()` executes its argument through a command shell. The path to `interactive.py` is interpolated into the command without quoting or argument separation. If the Skill is installed under a path containing shell metacharacters such as `;`, `&`, command substitution syntax, or redirection operators, the shell interprets those characters as command syntax rather than as part of the filename. The path does not originate from a normal command-line option, so exploitation requires influence over the Skill installation or parent-directory path. Nevertheless, this is an avoidable command-injection primitive because Python can launch the child process directly without a shell. ### Attack Path 1. An attacker causes the Skill to be installed, copied, or extracted beneath a directory whose name contains shell metacharacters and an attacker-selected command. 2. The user invokes `hivulseai_skill.py --interactive`. 3. The code builds a command string containing the crafted path. 4. `os.system()` passes the string to the platform shell. 5. The shell parses and executes the injected command in addition to, or instead of, launching `interactive.py`. ### Impact Assessment Successful exploitation executes arbitrary shell commands with the privileges of the user or Agent process running the Skill. This can allow the attacker to read or modify user-accessible files, steal credentials, alter Agent configuration, invoke network utilities, or execute additional programs. The issue does not independently provide administrative privileges, but its scope equals ...[truncated 45 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Avoid the shell and pass arguments as a list: ```python import subprocess subprocess.run( [sys.executable, str(interactive_path)], cwd=str(skill_dir), check=True, ) ``` Additional hardening should include: 1. Use `sys.executable` to ensure that the same Python interpreter is used. 2. Keep `shell=False`, which is the default for list-form `subprocess.run()`. 3. Resolve and validate `interactive_path` before execution. 4. Verify that the resolved script remains inside the expected Skill directory. 5. Handle `subprocess.CalledProcessError` without exposing sensitive command context. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: config.py:14
• Finding: API Key Stored in Plaintext Without Enforced Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `config.py:14-17` and `config.py:41-44` **Vulnerability Type**: Insecure local secret storage **Risk Level**: Medium ### Vulnerable Code ```python self.config_file = config_file self.config_dir = Path.home() / ".hivulseai" self.config_path = self.config_dir / config_file # Ensure the configuration directory exists self.config_dir.mkdir(exist_ok=True) ``` The API key is then serialized directly to the configuration file: ```python def save_config(self) -> bool: """Save configuration to file""" try: with open(self.config_path, 'w', encoding='utf-8') as f: json.dump(self.config, f, indent=2, ensure_ascii=False) return True except IOError: return False ``` ### Technical Analysis The API key is stored as plaintext JSON in `~/.hivulseai/config.json`. The application does not explicitly assign restrictive permissions to either the configuration directory or the file. Their permissions therefore depend on operating-system defaults and the process umask. On a system configured with a permissive umask, other local users or processes may be able to traverse the directory and read the configuration file. Rewriting an existing file also does not correct previously insecure permissions. ### Attack Path 1. A user runs the configuration wizard and enters an API key. 2. The application creates `~/.hivulseai` and writes `config.json` without explicitly enforcing owner-only permissions. 3. The host's umask or pre-existing file permissions permit access by another local account or process. 4. That principal reads the plaintext JSON file and obtains the API key. 5. The stolen key is used to access the associated external service within the key's authorization scope. ### Impact Assessment An attacker who can read the configuration file can impersonate the API-key owner to the extent permitted by the key. Potential effects include unauthorized API requests, access to acc ...[truncated 273 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create the configuration directory with owner-only permissions: ```python self.config_dir.mkdir(mode=0o700, exist_ok=True) os.chmod(self.config_dir, 0o700) ``` 2. Create the configuration file atomically with mode `0600`, and explicitly correct permissions on an existing file. 3. Write through a temporary owner-only file in the same directory and replace the destination atomically. 4. Prefer an operating-system credential store, such as Keychain, Credential Manager, Secret Service, or an equivalent secure secret provider. 5. Avoid storing the key unless persistence is explicitly requested. 6. Detect and warn about insecure existing permissions. 7. Never include the API key in diagnostics, backups, or exported configuration. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: hivulseai_openclaw.py:173
• Finding: Partial API Key Disclosure in Console and Agent Logs<![CDATA[ ## Vulnerability Details **File Location**: `hivulseai_openclaw.py:173-178` **Vulnerability Type**: Sensitive information exposure through logging **Risk Level**: Low ### Vulnerable Code ```python print(f"🚀 hivulseAI starts processing") print(f"📁 Directory: {directory}") print(f"📄 Document type: {doc_type}") print(f"📋 Task name: {task_name}") print(f"🔑 API key: {api_key[:10]}...") ``` ### Technical Analysis The wrapper prints the first ten characters of the API key. Terminal output may be retained in Agent transcripts, CI logs, shell recordings, service logs, support bundles, or monitoring platforms. Masking only the suffix still reveals a stable and potentially security-relevant portion of the credential. The actual exploitation value depends on the API key format and entropy. The exposed prefix may enable key correlation, reduce the unknown search space, identify an account or key family, or become useful when combined with another partial disclosure. ### Attack Path 1. The user invokes the OpenClaw wrapper with a configured API key. 2. The wrapper prints the first ten key characters. 3. OpenClaw, a terminal recorder, CI system, or service supervisor captures the output. 4. A person or process with log access retrieves the exposed prefix. 5. The prefix is used for credential correlation or combined with other leaked material to facilitate key recovery or misuse. ### Impact Assessment The issue exposes only a prefix rather than the complete credential, so direct authentication may not be possible from this finding alone. Nevertheless, the disclosure weakens secret confidentiality and expands the number of systems containing credential material. Anyone with access to retained logs may obtain the prefix. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all output derived from the API key. 2. Replace the message with a non-sensitive status such as `API key configured: yes`. 3. Review historical Agent and service logs and remove exposed key prefixes where feasible. 4. Rotate keys if logs are broadly accessible or if the key format makes the disclosed prefix security-sensitive. 5. Add automated tests or secret-scanning rules that reject logging of variables named `api_key`, `token`, `password`, or similar. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Unbounded and Unhashed Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-2` **Vulnerability Type**: Non-reproducible and insufficiently constrained dependency resolution **Risk Level**: Low ### Vulnerable Code ```text requests>=2.25.0 pathlib2>=2.3.0 ``` ### Technical Analysis Both dependencies use only lower version bounds. Any current or future package version satisfying those constraints may be selected during installation. The requirements file also contains no integrity hashes. This does not establish that either named package is malicious. The risk is that installations are non-reproducible and can silently receive unreviewed future releases. If a package release or package-distribution account is compromised, the documented installation command may retrieve and execute affected package code during installation or runtime. `pathlib2` is also unnecessary on modern Python versions because `pathlib` is available in the standard library, increasing the dependency surface without a demonstrated need. ### Attack Path 1. A user follows the documentation and runs `pip install -r requirements.txt`. 2. The package resolver selects the newest versions satisfying the lower bounds. 3. A newly released, compromised, or incompatible version is selected without any repository change. 4. Package installation or subsequent import executes code from that unreviewed version. 5. The package code operates with the privileges of the installing or invoking user. ### Impact Assessment If dependency infrastructure or an allowed future release is compromised, malicious package code could execute with the privileges of the Python installation process or Skill runtime. Depending on those privileges, it could read project files, access environment variables and API keys, modify user files, or communicate externally. No currently malicious dependency was confirmed during this static audit. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to a reviewed version rather than using an open-ended lower bound. 2. Generate a lockfile with transitive dependencies resolved. 3. Use hash verification, such as `pip install --require-hashes`, for release installations. 4. Review and update pinned versions through a controlled dependency-management process. 5. Remove `pathlib2` when the supported Python versions provide the standard-library `pathlib`. 6. Run dependency vulnerability and provenance checks in CI. 7. Install packages in an isolated virtual environment under a non-privileged account. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is document generation, but the behavior includes uploading files from a user-specified directory to a remote API and accessing local configuration to obtain credentials, without clearly declaring these as sensitive operations. In a developer environment, project directories often contain proprietary source code, secrets, configs, and customer data, so hidden or underexplained exfiltration behavior is highly dangerous.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill describes uploading files from a specified directory to an external API but does not prominently warn users that local code and possibly sensitive files will leave their environment. In the context of software projects, this can expose intellectual property, embedded secrets, internal architecture, and regulated data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The tool recursively enumerates files in the supplied directory and uploads them to a cloud API with only minimal extension/dir filtering and no explicit warning, preview, or confirmation of what will be sent. This can expose proprietary source code, secrets, internal documents, and personal data to a third party unintentionally.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

interactive_path = skill_dir / "interactive.py"

        if interactive_path.exists():
            os.system(f"python {interactive_path}")
        else:
            print("❌ 交互式模块不存在")
        return

• Confidence: 95% confidence
• Finding: The skill launches another Python script through a shell using os.system(f"python {interactive_path}"). Even though interactive_path is derived from the local file location rather than direct user input, invoking a shell is unnecessary and unsafe because shell-based execution increases attack surface, can behave unpredictably across environments, and may execute an unexpected interpreter or manipulated command context. In a skill that processes project directories, this becomes more sensitive because users may run it in semi-trusted environments with modified PATH or local files.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly states that files from a specified directory are uploaded to an API, but it does not clearly warn users that source code, configuration files, secrets, proprietary materials, or personal data may be transmitted off-host. In a software-development context, this omission is risky because users may run the tool against entire repositories and unknowingly exfiltrate sensitive project data to a third-party service.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises powerful capabilities including environment access, local file access, network use, and shell-like behavior, but does not declare any tool scope or permission boundaries. This removes an important transparency and policy-control layer, making it easier for the skill to read local code and transmit it externally without clear user or platform enforcement.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions require an API key but do not clearly emphasize that it is a sensitive credential that must not be exposed, logged, shared, or committed to source control. In developer workflows, insufficient warning around credential handling often results in accidental leakage through shell history, screenshots, configs, or repositories.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases are broad and overlap with normal developer conversation, increasing the chance the skill activates unintentionally. Because this skill may read a project directory and upload contents to an external API, accidental invocation materially raises the risk of unintended data disclosure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to store the API key in a local JSON config file in plaintext without warning about local disclosure risk. Plaintext credential storage increases exposure to other local users, malware, backups, accidental sharing, and repository inclusion if the file is copied into project space.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The manifest describes a tool for generating technical documentation from source directories, but this file implements persistent API key management by saving credentials in a user home-directory config file. Credential storage may be an implementation detail for a network-backed service, but the manifest does not state that the skill manages secrets locally, so this capability is broader than the documented purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The API key is persisted to ~/.hivulseai/config.json in plaintext via json.dump without any warning to the user or file-permission hardening. If another local user, backup system, malware, or misconfigured file sync accesses that file, the credential can be stolen and used to impersonate the user against the service.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: Nearly all prompts, descriptions, and CLI messages are presented only in Chinese, with no option for users to select another language or locale. This creates a natural-language policy issue when language choice is expected rather than a fixed locale being imposed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The constructor silently attempts to obtain API keys from multiple local configuration sources without informing the user. Even though the key is intended for service authentication, undisclosed access to local credential material violates least surprise and can normalize over-broad secret access patterns in agent skills.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill reads an API key from a hard-coded external file path in the user's home directory that is unrelated to the requested project directory. This expands data access beyond stated functionality and causes implicit credential harvesting behavior, especially because the key is then used to upload repository contents to a remote service.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

if i == 0:
                    # 第一个文件不带branch_id
                    result = self.upload_file(file_path,directory=directory, unified_file_path=unified_file_path)
                    self.repo_id = result.get('data',{}).get('repo_id')
                    self.default_branch_id = result.get('data',{}).get('default_branch_id')
                    print(f"✅ 第一个文件上传成功，repo_id: {self.repo_id}, branch_id: {self.default_branch_id}")

• Confidence: 98% confidence
• Finding: This call uploads the first local file to a cloud endpoint as part of a recursive project upload workflow. In this skill's context, that behavior is core functionality, but it is still dangerous because users are not given informed consent, file-by-file visibility, or strong filtering for secrets before source code leaves the machine.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration

Content

print(f"✅ 第一个文件上传成功，repo_id: {self.repo_id}, branch_id: {self.default_branch_id}")
                else:
                    # 后续文件带branch_id，使用相同的统一file_path
                    result = self.upload_file(file_path,directory=directory,branch_id= self.default_branch_id, unified_file_path=unified_file_path)
                    print(f"✅ 文件上传成功")

            except Exception as e:

• Confidence: 98% confidence
• Finding: This call continues uploading all remaining files in the target directory to cloud storage using the created branch identifier. Because the upload is recursive and broad, any overlooked sensitive files within the directory can be exfiltrated at scale to a third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

data = {"uuid": self.default_branch_id}

        try:
            response = requests.post(url, json=data, headers=self.headers)
            response.raise_for_status()

            result = response.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

data = {"uuid": self.default_branch_id}

        try:
            response = requests.post(url, json=data, headers=self.headers)
            response.raise_for_status()

            result = response.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The module description states behavior in Chinese, and all user-facing messages throughout the script are hard-coded in Chinese. This imposes a specific language/locale on users without offering a choice or documenting that the skill is intended only for a Chinese-language environment.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The manifest describes a code-to-document generation tool, but this wrapper also implements credential discovery by directly reading ~/.openclaw/openclaw.json and falling back to the HIVULSE_API_KEY environment variable. Accessing host configuration files and environment secrets is a broader capability than the stated documentation purpose and is not mentioned in the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The code launches hivulseai_skill.py via subprocess.run instead of performing generation directly in-process. For a skill described simply as an automated documentation generator, arbitrary process execution is an additional capability that increases operational scope and is not disclosed in the manifest.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'--task-name', task_name
            ]

            result = subprocess.run(cmd, cwd=skill_dir)
            sys.exit(result.returncode)
        else:
            print("❌ 主技能脚本不存在")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The module docstring and all user-facing CLI messages are written exclusively in Chinese, which imposes a specific language on users. The file does not offer an opt-in, alternate locale, or a documented justification that this skill is intended only for a Chinese-speaking or region-specific context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill exposes the ability to spawn a separate Python process in interactive mode, which is broader execution capability than is strictly necessary for document generation. While this appears intended for UX convenience rather than abuse, delegating execution to another script via a shell introduces avoidable process-execution behavior that can be abused in compromised environments or make security review harder. The context makes it somewhat less dangerous than arbitrary command execution because the target script is fixed, but it still expands the trusted code and execution surface.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code presents its title, prompts, status messages, and confirmations entirely in Chinese, which constitutes a language/locale constraint in natural-language content. The file does not offer opt-in, selection, or any documented justification that the skill is intentionally region-specific.

Static analysis

No suspicious patterns detected.