WideHive

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:01 AM UTC
• Version: 1.4.0

Overview

WideHive is a disclosed wide-research automation skill, but Review is warranted because unvalidated target slugs and spreadsheet exports can create unintended local file access or CSV formula risks with untrusted inputs.

Install only if you are comfortable granting this skill web access, sub-agent spawning, and workspace file read/write for large research runs. Keep run directories contained, accept target lists only from trusted sources, require slugs to use a safe filename pattern such as letters, digits, underscores, and hyphens, and be cautious opening generated CSV files in Excel or similar apps unless formula-like cells have been neutralized.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/merge_results.py:56

Finding

Path Traversal Through an Unvalidated Target Slug

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/merge_results.py:83

Finding

Spreadsheet Formula Injection in Generated CSV Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description emphasizes an active orchestration system for large-scale research: launching many context-isolated sub-agents, merging their outputs, and producing shaped reports. The supplied code does not perform those tasks. It only discovers existing run directories, parses already-produced JSON artifacts, and writes a consolidated corpus and index. This is a materially different primary purpose: corpus consolidation of finished runs rather than wide research orchestration or report synthesis. The file operations are consistent with local post-run processing, and there are no suspicious undeclared external accesses, but the main behavior still does not match the declared skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents the skill as a broad research orchestration system that dispatches many context-isolated sub-agents, performs batch research, merges outputs programmatically, and synthesizes scenario-specific reports. The supplied code chunk does not perform any of those core behaviors. Instead, it only loads an existing merged.json artifact and renders it into an interactive HTML dashboard using embedded CSS/JavaScript, including search, sorting, detail views, and up to two simple numeric charts. This is related to presentation of WideHive outputs, but it is materially narrower and different from the declared primary purpose. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly instructs workers to read and write files across a workspace run directory, but it does not declare any tool scope or allowed-tools boundaries. That creates an authorization ambiguity where an agent runner may grant broader file capabilities than intended, increasing the chance of unintended file access or overwrite if prompts, paths, or surrounding harness behavior are manipulated.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

text

You are a Wide Research single-object worker. Handle ONLY this one object;
do not expand scope.

Object: <name> (<url or unique identifier>)
Task:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code emits a generated HTML document with the root element fixed to lang="en". The file contains no user opt-in, configuration option, or documented reason for forcing English, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.