ClawHub
Back to skill

Security audit

HiveFence

Security checks across malware telemetry and agentic risk

Overview

HiveFence is a coherent security skill that openly describes network-based threat sharing, but users handling sensitive prompts should review its automatic hash reporting before use.

Install this only if you are comfortable with a third-party threat-intelligence service receiving SHA-256 hashes of detected prompt-injection patterns. For private, regulated, or strict local-only environments, ask the publisher for exact transmitted fields, retention policy, and a documented way to disable reporting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly states that new attack patterns are "hashed and submitted to the network," but the description does not clearly warn users that using the protection feature triggers outbound reporting to a remote service. Even if only hashes are sent, this is still network exfiltration of derived prompt data and may leak sensitive, linkable, or policy-relevant information in environments that require strict local-only processing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.