skills/hive-intel/hive-skills/hive/Gen Agent Trust Hub

hive

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the hive-intelligence package from the official npm registry during setup and fetches updates from the hive-intel GitHub repository. These operations target well-known registries and official vendor resources.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands via npx and the hive CLI for initialization (hive init), version management, and data retrieval. These commands are integral to the skill's primary function of providing live intelligence.
  • [PERSISTENCE]: The hive routing install command modifies project-level configuration files (AGENTS.md or CLAUDE.md) to insert a persistent routing block. This feature is opt-in and allows the agent to maintain context for Hive data across different sessions.
  • [INDIRECT_PROMPT_INJECTION]: As a data-fetching tool, the skill ingests content from over a dozen external crypto data providers.
  • Ingestion points: Data enters the context via invoke_api_endpoint (MCP) and hive tools call (CLI).
  • Boundary markers: The skill mandates the inclusion of _hive receipt blocks for every material response.
  • Capability inventory: The skill can execute subprocesses (hive, npx) and write to specific project files (AGENTS.md, CLAUDE.md).
  • Sanitization: The skill provides a validate_task_result tool to perform structural checks on typed workflow results before they are presented.
  • [CREDENTIALS_SAFE]: The skill instructions demonstrate a strong security posture regarding API keys, explicitly forbidding the storage or echoing of keys in transcripts or commands, and recommending the use of environment variables or the vendor's local authentication flow.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 07:54 PM