skills/ruvnet/ruflo/hive-mind/Gen Agent Trust Hub

hive-mind

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to use 'npx' to download and execute the 'claude-flow' package from the NPM registry. While NPM is a well-known service, the package is executed without specific version pinning, relying on the latest available version at runtime.
  • [COMMAND_EXECUTION]: The skill provides various commands for initializing swarm topologies, spawning queen/worker agents, and monitoring consensus status through the 'claude-flow' utility.
  • [INDIRECT_PROMPT_INJECTION]: The implementation of Byzantine fault-tolerant consensus mechanisms involves processing data and state from multiple distributed agents. This architectural pattern creates a surface where one compromised or malicious agent node could attempt to inject instructions into the collective decision-making process. (1) Ingestion points: Swarm coordination and consensus strategies defined in SKILL.md. (2) Capability inventory: Shell command execution and multi-agent coordination via 'npx claude-flow'. (3) Boundary markers: None explicitly defined in the skill instructions. (4) Sanitization: No sanitization or validation protocols for inter-agent communication are specified in the instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:38 AM
Security Audit — agent-trust-hub — hive-mind