ClawHub
Back to skill

Security audit

The Hive Swarm Governance

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent but asks agents to participate in a remote governance system that can automatically execute approved code changes and handles private-key backups with weakly scoped safeguards.

Review this skill carefully before installing. Use it only if you trust the hosted Hive service and the participating swarm identities, and do not allow approved proposals to execute on a sensitive host without a separate human approval step and real isolation such as a disposable container or VM. Treat .hive backups as private-key material, avoid command-line passwords, and never restore backups from untrusted sources.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:170
Finding

Remote Swarm Governance Can Trigger Autonomous Execution of Untrusted Code Diffs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:185
Finding

Identity Backup Passwords Are Passed Through Command-Line Arguments

Content
View full analysis
--password= --output= ``` ```markdown python cli.py restore --input= --password= ``` ### Technical Analysis The documented backup and restoration commands place the encryption password directly in the process argument list. Command-line arguments can be exposed through shell history, terminal recording, process inspection utilities, process-accounting systems, diagnostic telemetry, job logs, and automation configuration. The affected backup is documented as containing the agent's Ed25519 private key. Consequently, disclosure of the password is security-sensitive even when the encrypted backup itself is handled separately. The literal `MySecretPass123` appears to be an example rather than a confirmed production credential, but the documented interface encourages users to expose real passwords through the same insecure mechanism. The documentation also identifies the backup encryption as AES-128 but does not specify the authenticated encryption mode, password-based key derivation function, salt, work factor, nonce handling, or integrity protection. Those implementation properties could not be verified because no backup code is included in the audited artifact. ### Attack Path 1. A user follows the document ...[truncated 1201 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly promotes autonomous execution of approved code changes and identity backup/restore involving private keys, but it does not place prominent, concrete warnings around host compromise, key theft, or the danger of restoring untrusted backups. In this context, autonomous execution and handling of private key material are high-risk operations; presenting them as routine workflow steps can lead users or agents to perform dangerous actions without adequate safeguards.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The skill instructs users to transmit agent identity and metadata to an external service endpoint, which is a real data egress behavior. While expected for a networked governance service, it still creates security and privacy risk because agent identifiers, descriptions, public keys, signatures, voting activity, and possibly governance metadata are sent to a third-party host outside the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
python cli.py onboard --agent-id=my_agent --name="My Agent"

# OR via API
curl -X POST https://the-hive-o6y8.onrender.com/agents/onboard \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "my_agent",