message-hub-socneo

Message Hub - AI Team Message Hub Client for async collaboration

Security Scan

The package mostly matches its description (a simple HTTP client for a Message Hub) but the registry metadata omits required credentials and the package contains duplicated files and a CLI bug—these incoherences warrant caution before installing or providing secrets.

Purpose & Capability

The code implements a Message Hub client (push/pull/broadcast/health/stats) consistent with the name/description. However the registry lists no required environment variables or primary credential while the code requires MESSAGE_HUB_API_KEY (and uses MESSAGE_HUB_URL and MESSAGE_HUB_SENDER). The omission in metadata is an incoherence that can cause confusion or misconfiguration.

Instruction Scope

SKILL.md and README only instruct usage relevant to a message hub client (install requests, set MESSAGE_HUB_* env vars, examples). The runtime instructions and source code do not attempt to read unrelated host files or hidden credentials, nor do they contact unexpected external hosts (requests target the configured base_url).

Install Mechanism

No install spec is provided (instruction-only install). The README asks to pip install requests which is proportional. Nothing in the package downloads arbitrary code from external URLs or writes installers—low install-risk.

Credentials

The client legitimately needs an API key (MESSAGE_HUB_API_KEY) and optionally MESSAGE_HUB_URL and MESSAGE_HUB_SENDER. But the registry metadata reported 'Required env vars: none', which is incorrect. The code will raise an error if MESSAGE_HUB_API_KEY is not set. Requesting an API key is proportional to purpose, but the metadata mismatch and lack of declared primary credential are problematic and could lead to accidental exposure or misconfiguration.

Persistence & Privilege

The skill does not request persistent/always-on privileges, does not modify other skills or system-wide settings, and does not enable autonomous invocation beyond the platform default. No persistence/privilege escalation observed.

What to consider before installing

This package appears to be a straightforward client for a Message Hub, but be cautious: the registry metadata does not declare the environment variables the code actually needs. The client requires MESSAGE_HUB_API_KEY (and optionally MESSAGE_HUB_URL and MESSAGE_HUB_SENDER). Before installing or supplying secrets: 1) Verify the source and trustworthiness of the message hub server you will point to (do not give keys to untrusted endpoints). 2) Treat MESSAGE_HUB_API_KEY as sensitive—use per-service keys with least privilege and rotate them. 3) Note small packaging issues: the repo contains two duplicate Python modules and the CLI code has a bug (uses add_argument instead of parser.add_argument) which will cause runtime errors; test locally in a safe environment first. 4) If you need assurance, ask the publisher for corrected registry metadata, a canonical single module, and an explanation of why files are duplicated and why required env vars were omitted.

Message Hub

Python client for AI Team Message Hub, enabling message push, pull, and broadcast for AI team collaboration.

Overview

This skill provides a Python client for interacting with the Tianma Message Hub. It enables AI assistants to send tasks, notifications, and receive messages asynchronously.

Features

• Push messages to hub
• Pull pending messages
• Broadcast to Feishu group (Tianma only)
• Message signature verification
• Automatic retry mechanism
• Async message processing

Requirements

• Python 3.8+
• requests library
• Message Hub API credentials

Usage

See README.md for detailed usage instructions.

Security Notes

• Never commit API keys to version control
• Use environment variables for credentials
• Rotate API keys periodically

Changelog

v1.0.0 (2026-03-18)

• Initial release
• Basic push/pull functionality
• Security audit passed