hive-build-onboarding
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to execute
npx -y -p hive-intelligence@latest hive init --browser. This fetches the official CLI tool from the vendor's package repository on npm. This is a standard and safe practice for onboarding CLI tools from a trusted vendor. - [COMMAND_EXECUTION]: Provides commands for the user to run manually (
hive init,hive doctor,curl). These commands are used for local configuration and verification of the vendor's own services. No autonomous or hidden command execution was detected. - [DATA_EXFILTRATION]: The skill explicitly instructs users not to paste secrets into chat or logs. It describes a secure authentication flow where the API key is passed directly from a local browser redirect to a local CLI listener, ensuring the secret remains outside the agent's context and logs.
- [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The documentation correctly handles placeholders like
hive_live_…andHIVE_API_KEY, and it provides accurate advice on revoking lost keys and using secret managers.
Audit Metadata