skills/adenhq/hive/hive-patterns/Gen Agent Trust Hub

hive-patterns

Pass

Audited by Gen Agent Trust Hub on Feb 12, 2026

Risk Level: LOWNO_CODE
Full Analysis

The skill hive-patterns is a Markdown document that serves as a reference guide. It outlines design patterns and best practices for constructing AI agents, including code snippets for illustration. It does not contain any executable code that Claude would run on its host system.

  • Prompt Injection: No prompt injection attempts targeting Claude were found. The system_prompt examples are for agents being built, not for Claude itself.
  • Data Exfiltration: No commands or patterns for data exfiltration were detected. The save_data, load_data, serve_file_to_user are described as internal MCP tools within the hive framework, not direct system commands for exfiltration.
  • Obfuscation: No obfuscation techniques (Base64, zero-width characters, homoglyphs, etc.) were found.
  • Unverifiable Dependencies: The skill does not instruct Claude to install any external dependencies. References to Pydantic, asyncio, etc., are standard Python libraries or framework components, not external downloads initiated by the skill.
  • Privilege Escalation: No commands for privilege escalation (sudo, chmod 777, etc.) were found.
  • Persistence Mechanisms: No commands for establishing persistence (.bashrc modification, crontab, etc.) were found.
  • Metadata Poisoning: The metadata fields (name, description, author, license) are benign and accurately describe the skill's content.
  • Indirect Prompt Injection: The skill describes building agents that use client_facing=True nodes to interact with users and process user input. While this is a feature of the agents being built, it means that agents constructed using these patterns are inherently susceptible to indirect prompt injection from malicious user input. This is a risk of the agent's design, not a vulnerability in the hive-patterns skill itself. This is noted as an informational finding.
  • Time-Delayed / Conditional Attacks: No time-delayed or conditional attack patterns were found.

The skill is purely informational and does not execute any code or perform any actions on the user's system.

Audit Metadata
Risk Level
LOW
Analyzed
Feb 12, 2026, 10:34 PM