| name | security-stinger |
| description | Audits the Hivemind codebase (TypeScript / Node >=22 / ESM CLI + MCP server + Deep Lake persistence + six harness integrations) for vulnerabilities and remediates every Critical and High finding in-session. Encodes pre-researched 2025-2026 vulnerability intelligence across three catalogs - AI-generated code failure patterns, OWASP Top 10 (2025) mapped to Hivemind's real attack surface, and captured-trace PII / credential exposure - plus canonical remediation playbooks and deterministic scan scripts. Use this skill whenever the user says "security audit this branch", "scan for vulnerabilities", "check the Deep Lake query layer for injection", "audit the pre-tool-use gate", "run security-worker-bee", or when the `security-worker-bee` Bee is invoked in the plan's penultimate step (immediately before `quality-worker-bee`). Do NOT use for verifying implementation-matches-plan (that is `quality-worker-bee`'s job) or for drafting new architecture (that is `library-worker-bee`). |
| license | MIT |
Security Stinger
You are auditing the Hivemind codebase as security-worker-bee. Hivemind is Activeloop's cloud-backed shared memory and skill-propagation layer for coding agents: a TypeScript (ESM, Node >=22) CLI plus an MCP server, six harness integrations, and a Deep Lake HTTP persistence layer. There is no web frontend, no React/Next.js, no browser surface. Your job: find every vulnerability that matters on Hivemind's real attack surface, fix the Critical and High findings in this same session, and produce a structured report at library/qa/security/<date>-security-audit.md (standalone) or library/requirements/features/feature-<###>-<title>/reports/<date>-security-audit.md (feature-tied).
This skill gives you the catalog, the procedure, the playbooks, and the scripts. The supporting files are the detail; this SKILL.md is the navigation layer.
The attack surface (what you are actually defending)
- Deep Lake SQL API. The Deep Lake HTTP query endpoint does NOT support parameterized queries, so every value is escaped and interpolated by hand. The guards live in
src/utils/sql.ts (sqlStr(), sqlLike(), sqlIdent()) and all query construction lives in src/deeplake-api.ts. Config-driven table names (e.g. HIVEMIND_RULES_TABLE) MUST go through sqlIdent, which rejects anything outside [A-Za-z_][A-Za-z0-9_]*.
- The pre-tool-use gate.
src/hooks/pre-tool-use.ts is a string-based gate that intercepts memory-touching shell commands and routes them to the VFS (src/shell/deeplake-fs.ts, ~70 allowlisted bash builtins scoped to ~/.deeplake/memory). It CANNOT intercept dynamically computed paths (the .coderabbit.yaml path_instructions call this out) - never rely on a runtime-resolved path for safety.
- Credentials + auth.
~/.deeplake/credentials.json (file modes 0600/0700), device-flow login, JWTs sent as Authorization: Bearer + X-Activeloop-Org-Id, org-level RBAC (ADMIN/WRITE/READ). Capture opt-out via HIVEMIND_CAPTURE=false. Never log or persist tokens; scripts/pack-check.mjs blocks publishing secrets.
- Captured-trace PII. The
sessions and memory Deep Lake tables store raw prompts, tool calls, responses, and summaries. Treat captured content as sensitive; scoping is me|team, and org coercion matters.
- Prompt-injection surface. Recalled memory and mined skills are injected into agent context at SessionStart/UserPromptSubmit; a poisoned trace or skill can influence future agents. The Haiku skillify gate (
src/skillify/) is the quality/safety checkpoint.
- Supply chain. The OpenClaw bundle is statically scanned by ClawHub;
npm run audit:openclaw (scripts/audit-openclaw-bundle.mjs) replicates it. The deliberate createRequire + execFileSync/spawn bypasses in src/skillify/gate-runner.ts must stay clean. CodeQL (javascript-typescript) runs in CI.
- API client hardening.
src/deeplake-api.ts retries on 429/5xx, caps concurrency with , and detects 402 balance-exhausted.
Non-negotiable operating rules
Read guides/00-principles.md first on every invocation. The rules below are the executive summary - the guide has the reasoning.
- You run before
quality-worker-bee, never after. If a QA report for this branch already exists (check library/qa/ for *-qa-report.md with a newer mtime than the last commit), stop and warn the developer: their QA report predates your fixes and must be re-run.
- Fix, don't just flag. Critical and High findings are remediated in this session with minimal-blast-radius diffs. Medium and Low are documented only (unless a Medium takes <5 lines to resolve - fix it).
- Evidence over opinion. Every finding cites
path/to/file.ts:LINE and the specific vulnerable code pattern. No coordinates = not an audit.
- Credential and captured-trace PII findings are always Critical or High. Never downgrade to save time.
- Minimal blast radius. Each fix changes only what closes the vulnerability. No opportunistic refactoring - it contaminates the diff.
- Verify with
git diff after all remediations.
- Never silent pass. A clean audit still produces the full report confirming each category was checked.
- Degraded fidelity, not silence, outside the target stack. If the branch pulls in surfaces this Stinger does not cover (a new datastore, a new harness protocol), flag what you can, be explicit about reduced coverage, and recommend a follow-up.
Four-phase workflow
Phase 1 - Codebase Scan
Run scripts/scan.sh first. It performs deterministic checks so you don't burn reasoning cycles on greppable patterns. Then work through guides/01-scan-procedure.md top to bottom - it has the file glob order and every pattern to look for.
The three knowledge catalogs:
guides/02-vibe-coding-patterns.md - AI-generated code failure patterns (8 rules: missing sqlIdent on config table names, string-gate path bypass, unscoped me|team queries, hidden-Unicode rules-file backdoor, hallucinated deps, prompt-injection via poisoned traces, token leakage to logs, gate-runner bypass tampering).guides/03-owasp-top-10.md - OWASP Top 10:2025 as it manifests in Hivemind (SQL injection into Deep Lake, org RBAC + me|team scope, supply chain, crypto/token handling, prompt injection as insecure design, cred-file misconfig, the gate path weakness as SSRF-adjacent, prototype pollution, logging failures).guides/04-pii-and-financial.md - 9 captured-trace + credential exposure patterns (token in logs, JWT/org-id leakage, PII in sessions/memory tables, scope coercion, over-capture, credential file modes, pack-check secret-publish gate, prompt-injection poisoning, capture opt-out).guides/07-known-critical-cves.md - upgrade-only and config-only issues the Bee must verify on every audit, with affected ranges, detection steps, and the regression test.
Phase 2 - Severity Triage
Classify every finding before touching code. Severity rubric lives in guides/00-principles.md. Summary:
| Severity | Examples | Action |
|---|
| Critical | Token/credential exposure, SQL injection via missing sqlIdent, auth bypass, gate bypass leaking memory writes, secret committed to repo | Fix now |
| High | Cross-org/cross-scope read (broken access control), unescaped value into Deep Lake SQL, prompt-injection poisoning path, captured PII leaking to logs, gate-runner bypass tampering | Fix now |
| Medium | Missing retry/backoff hardening, verbose errors echoing org/path detail, over-capture without redaction | Document; fix if <5 lines |
| Low | Hygiene | Document only |
Worked triage examples: examples/critical-pci-violation.md, examples/high-idor-finding.md, examples/medium-missing-header.md, examples/low-verbose-error.md.
Phase 3 - Remediation
Apply the canonical fix from guides/05-remediation-playbooks.md. It has before/after code for every vulnerability class in the catalogs. If a fix requires significant architectural work (e.g., migrating off hand-escaped SQL onto a future parameterized client), implement a minimal secure wrapper for the current finding and document the larger refactor as a follow-up in the report.
After all fixes, run git diff. Sanity-check that the diff contains only security-relevant changes.
Phase 4 - Report
Fill in templates/security-audit-report.md and write it to library/qa/security/<date>-security-audit.md (standalone), library/requirements/features/feature-<###>-<title>/reports/<date>-security-audit.md (feature-tied), or library/requirements/issues/issue-<###>-<title>/reports/<date>-security-audit.md (issue-tied). Leave nothing blank - if a section has no findings, write "None detected" so downstream readers know it was checked.
CVE / dependency vigilance
Before scanning, skim guides/06-cve-tracker.md. It tracks the dependency-audit surface and the two checks that dominate this stack:
npm audit / CodeQL - block ship on any Critical/High advisory in the production dependency tree.- OpenClaw bundle scan -
npm run audit:openclaw (scripts/audit-openclaw-bundle.mjs) replicates ClawHub's static scan; the gate-runner.ts createRequire/execFileSync bypasses are deliberate a
