skills/holon-run/uxc/hive-mcp-skill/Gen Agent Trust Hub

hive-mcp-skill

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses uxc link to connect to https://hiveintelligence.xyz/mcp. This is the official endpoint for the Hive Intelligence service as described in the skill's purpose and documentation. These downloads are restricted to retrieving the Model Context Protocol (MCP) tool definitions from the vendor's infrastructure.
  • [COMMAND_EXECUTION]: The skill instructs the agent to use uxc and a linked alias hive-mcp-cli to perform market data discovery and retrieval. All command patterns (e.g., get_market_and_price_endpoints, invoke_api_endpoint) are standard operations for the described service and do not include dangerous or arbitrary shell execution.
  • [REMOTE_CODE_EXECUTION]: No remote script execution or piped shell commands (like curl | bash) are present. The skill operates by invoking structured API endpoints via a controlled CLI tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes market and on-chain data which is external content. However, it implements strong safety guardrails by mandating schema inspection (get_api_endpoint_schema) before invocation and advising the agent to process structured JSON output rather than raw text, which mitigates the risk of instructions embedded in data influencing the agent's behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 10:15 PM