hive-intelligence 1.1.2 → 1.1.4

package/agent-skills/packs/hive-security-risk/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: hive-security-risk
+description: Use this skill before advising on swaps, approvals, signatures, dApps, contracts, URLs, or transaction payloads where token, address, approval, phishing, or simulation risk matters. Report severity, evidence, and remediation instead of guessing.
+license: MIT
+metadata:
+  package: "@hiveintelligence/agent-skills"
+  category: "security"
+  requires_network: "true"
+version: 1.0.0
+---
+
+# hive-security-risk — Security Risk
+
+Use this skill before explaining swaps, approvals, signatures, dApps, or
+unknown contracts.
+
+## Task toolset
+
+Use `security_risk`.
+
+Required identifiers: chain and token contract, wallet address, spender,
+dApp URL, or transaction payload depending on the request.
+
+## Procedure
+
+Read `references/workflow.md` when the request involves signing, approvals,
+dApps, simulations, or any risk report that needs severity and remediation.
+
+1. Identify the asset, address, approval, dApp, or transaction payload.
+2. Run token/address/approval/phishing/simulation checks as appropriate.
+3. Report severity, evidence, and remediation steps.
+4. Do not provide signing guidance when critical risk is unresolved.
+
+## Example
+
+For an ERC-20 approval concern, collect chain, token contract, owner wallet, and
+spender before selecting the approval or allowance tool.
+
+## Runtime status handling
+
+`rate_limited` and `degraded` can be retried with backoff. `plan_required` means
+the tool exists but the upstream account cannot execute it right now.

package/agent-skills/packs/hive-security-risk/evals/evals.json

@@ -0,0 +1,27 @@
+{
+  "skill_name": "hive-security-risk",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Is it safe to approve this spender for my ERC-20 token?",
+      "expected_output": "Uses security_risk, asks for chain/token/owner/spender if missing, checks approval risk, and avoids signing guidance until risk is resolved.",
+      "files": [],
+      "assertions": [
+        "Chooses security_risk.",
+        "Requests missing approval identifiers.",
+        "Does not tell the user to sign while risk is unresolved."
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Check whether this dApp URL and contract look phishing-related before I connect my wallet.",
+      "expected_output": "Routes to dApp/address/phishing checks, reports severity/evidence/remediation, and caveats missing provider data.",
+      "files": [],
+      "assertions": [
+        "Includes phishing or dApp risk checks.",
+        "Reports severity and evidence.",
+        "Provides remediation or next action."
+      ]
+    }
+  ]
+}

package/agent-skills/packs/hive-security-risk/references/workflow.md

@@ -0,0 +1,46 @@
+# Security Risk Workflow
+
+Use this reference for token, address, approval, dApp, phishing, contract, and
+transaction simulation risk.
+
+## Required identifiers
+
+- Chain/network.
+- One or more of: token contract, wallet address, spender address, dApp URL,
+  contract address, or transaction payload.
+
+Ask for missing chain and actor details before approval or simulation checks.
+Never invent a spender, owner, calldata, or URL.
+
+## Tool selection order
+
+1. Identify the risk object: token, address, approval, dApp, contract, or
+   transaction.
+2. Use `search_tools` for the matching security/risk endpoints.
+3. Inspect schemas before invocation.
+4. Run the narrowest risk check first.
+5. Add simulation or approval analysis only when the required payload/owner
+   details exist.
+
+## Bounded calls
+
+- Keep risk checks scoped to the provided contract, address, or payload.
+- Avoid broad scans unless the user explicitly asks for an audit.
+- Use severity and evidence rather than unsupported certainty.
+
+## Report template
+
+- Summary: risk level and safest recommendation.
+- Calls made: endpoints, chain, risk object, identifiers.
+- Evidence: flags, simulation results, approval exposure, source/freshness.
+- Caveats: missing payload, incomplete provider coverage, degraded/rate-limited
+  provider.
+- Next action: revoke approval, avoid signing, retry simulation, or provide
+  missing payload.
+
+## Gotchas
+
+- A token can pass metadata checks and still be risky.
+- `plan_required` means the tool exists but cannot run under current upstream
+  credentials.
+- Do not provide signing instructions when a critical risk is unresolved.

package/agent-skills/packs/hive-solana-analysis/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: hive-solana-analysis
+description: Use this skill for Solana-specific analysis covering wallets, SPL token accounts, DAS assets, parsed transactions, priority fees, launch data, mints, or Solana NFT assets. Prefer Solana-native identifiers and providers over EVM assumptions.
+license: MIT
+metadata:
+  package: "@hiveintelligence/agent-skills"
+  category: "solana"
+  requires_network: "true"
+version: 1.0.0
+---
+
+# hive-solana-analysis — Solana Analysis
+
+Use this skill for Solana wallets, mints, SPL accounts, DAS assets, parsed
+transactions, priority fees, or Solana token safety questions.
+
+## Task toolset
+
+Use `solana_analysis`.
+
+Required identifiers: Solana wallet, mint, asset id, or transaction signature.
+
+## Procedure
+
+Read `references/workflow.md` when the request needs Solana-native identifier
+handling, DAS/SPL routing, priority-fee context, or a structured Solana report.
+
+1. Confirm the identifier type: wallet, mint, asset id, program id, or
+   transaction signature.
+2. Use Solana-native tools instead of EVM assumptions.
+3. For wallets, combine balances, token accounts, assets, and parsed history.
+4. For execution context, include slot/priority fee/freshness.
+
+## Example
+
+If the user gives a mint, use token/security or asset search paths. If the user
+gives a wallet, use owner/balance paths.
+
+## Runtime status handling
+
+Classify Helius or Solana provider issues as `missing_key`, `rate_limited`,
+`degraded`, or `failing`. Ask for a retry only when the status is transient.

package/agent-skills/packs/hive-solana-analysis/evals/evals.json

@@ -0,0 +1,27 @@
+{
+  "skill_name": "hive-solana-analysis",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Analyze this Solana wallet's SPL token accounts and recent parsed activity.",
+      "expected_output": "Uses solana_analysis, treats the identifier as Solana-native, inspects schemas, bounds token/history calls, and reports slot/freshness/runtime status.",
+      "files": [],
+      "assertions": [
+        "Chooses solana_analysis.",
+        "Avoids EVM assumptions.",
+        "Reports Solana-specific freshness such as slot or fetched time."
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Check this Solana mint and whether there are any asset or launch-data signals.",
+      "expected_output": "Classifies the identifier as a mint, uses Solana token/DAS/launch paths, and reports provider caveats.",
+      "files": [],
+      "assertions": [
+        "Classifies mint versus wallet.",
+        "Uses Solana-native tool discovery.",
+        "Reports provider/runtime caveats."
+      ]
+    }
+  ]
+}

package/agent-skills/packs/hive-solana-analysis/references/workflow.md

@@ -0,0 +1,42 @@
+# Solana Analysis Workflow
+
+Use this reference for Solana wallets, SPL accounts, DAS assets, parsed
+transactions, priority fees, launch data, mints, and Solana NFTs.
+
+## Required identifiers
+
+- Solana wallet, mint, token account, asset id, program id, or transaction
+  signature.
+- Optional: slot/time window, owner, collection, or token filter.
+
+Do not apply EVM address, chain id, or approval assumptions to Solana requests.
+
+## Tool selection order
+
+1. Classify the identifier: wallet, mint, token account, asset, program, or
+   transaction.
+2. Use `search_tools` for Solana wallet, SPL token, DAS, parsed transaction,
+   priority fee, or launch-data tools.
+3. Inspect schemas before invocation.
+4. Use wallet paths for owner/balance/history questions.
+5. Use mint/asset paths for token/NFT questions.
+
+## Bounded calls
+
+- Limit parsed history, asset lists, and token accounts.
+- Include slot or fetched time where available.
+- Avoid multi-provider mixing without source labels.
+
+## Report template
+
+- Summary: Solana-specific read.
+- Calls made: endpoints, identifiers, filters.
+- Evidence: balances/assets/transactions/fees, source/freshness/runtime status.
+- Caveats: missing key, rate limit, DAS coverage, stale slot, truncated history.
+- Next action: transaction drilldown, asset verification, or risk check.
+
+## Gotchas
+
+- Wallets, mints, token accounts, and asset ids are different identifiers.
+- Priority fee estimates are time-sensitive.
+- Parsed transaction coverage can vary by provider and transaction type.

package/agent-skills/packs/hive-stateful-monitoring/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: hive-stateful-monitoring
+description: Use this skill when a user asks Hive to remember, monitor, schedule, alert, or report on crypto intelligence across sessions. Creates durable monitor intent through Hive's stateful monitoring tools.
+license: MIT
+metadata:
+  package: "@hiveintelligence/agent-skills"
+  category: "stateful-monitoring"
+  requires_network: "true"
+version: 1.0.0
+---
+
+# hive-stateful-monitoring - Stateful Monitoring
+
+Use this skill when the user wants Hive to remember a wallet, token, protocol,
+market, prediction market, watchlist digest, token discovery risk workflow, or
+risk watch workflow and keep reporting on it later.
+
+## Task toolset
+
+Use `stateful_monitoring`.
+
+Required identifiers: monitor kind and target object.
+
+For B2B adapter mode, Hive state is isolated by server-injected subject context:
+`partner API key -> Hive owner user_id -> tenant_id -> end_user_id -> subject_id`.
+The adapter must sign `METHOD + "\n" + PATH + "\n" + TENANT_ID + "\n" +
+END_USER_ID + "\n" + TIMESTAMP` with HMAC-SHA256 and send the
+`X-Hive-Tenant-Id`, `X-Hive-End-User-Id`, `X-Hive-Subject-Timestamp`, and
+`X-Hive-Subject-Signature` headers. Never ask the model or end user to provide
+`__hive_user_id` or `__hive_subject_id`; those are hidden server-injected args.
+In TypeScript backends with controlled source or release-tarball access, use
+`hive-mcp-client` with `subjectSigningSecret` and per-call
+`subject`/`withSubject(...)` context instead of hand-building these headers.
+
+## Procedure
+
+1. Convert the user's durable intent into a monitor `kind`, `target`, `rules`,
+   and `cadence`.
+2. Use `hive_create_monitor` for new watch requests.
+3. Use `hive_list_monitors` before creating a duplicate monitor.
+4. Use `hive_update_monitor` to change cadence, rules, target, metadata, or
+   status.
+5. Use `hive_archive_monitor` when the user asks Hive to stop watching.
+6. Use `hive_get_monitor_runs`, `hive_list_observations`,
+   `hive_list_alerts`, `hive_get_latest_snapshot`, or
+   `hive_generate_monitor_report` when the user asks what changed, what is
+   alerting, or what Hive remembers from previous runs.
+7. Use `hive_update_alert_status` when the user acknowledges, reopens, or
+   resolves an alert.
+8. Use `hive_remember_fact`, `hive_list_memory_facts`, and
+   `hive_forget_memory_fact` for durable user-scoped facts that should appear
+   in future monitor reports.
+9. Use `hive_list_subjects`, `hive_get_subject`, `hive_archive_subject`, and
+   `hive_list_subject_audit_events` only when operating or auditing a B2B
+   adapter's downstream state boundaries.
+10. Explain that monitor execution is handled by Hive workers, not by the
+   current chat session. Worker-supported monitor kinds are wallet, token,
+   protocol, market, prediction_market, watchlist_digest,
+   token_discovery_risk, and risk_watch.
+
+## Example
+
+For "Watch this Ethereum wallet and tell me when it moves more than $100k",
+create a wallet monitor with an Ethereum address target, a large-transfer rule,
+and the requested cadence or default cadence.
+
+For "Send every customer a daily crypto watchlist brief", create a
+`watchlist_digest` monitor per B2B subject with saved wallets, tokens,
+protocols, markets, and optional prediction markets in the target.
+
+## Runtime status handling
+
+If stateful tools return `missing_key` or an auth-required error, explain that
+hosted MCP authentication or the Hive persistence backend must be configured
+before durable monitoring can be used. Do not pretend the monitor was saved.

package/agent-skills/packs/hive-stateful-monitoring/evals/evals.json

@@ -0,0 +1,49 @@
+{
+  "skill_name": "hive-stateful-monitoring",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Watch this Ethereum wallet and alert me when it transfers more than $100k.",
+      "expected_output": "Uses stateful_monitoring, creates or updates a wallet monitor with an Ethereum address target, a large-transfer rule, and a durable cadence.",
+      "files": [],
+      "assertions": [
+        "Chooses stateful_monitoring.",
+        "Maps the request to a wallet monitor target.",
+        "States that Hive workers execute the monitor later."
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Show me the crypto monitors Hive already remembers and pause the one watching PEPE.",
+      "expected_output": "Lists existing monitors before mutation, identifies the relevant token monitor, and updates its status to paused instead of creating a duplicate.",
+      "files": [],
+      "assertions": [
+        "Calls hive_list_monitors before updating.",
+        "Uses hive_update_monitor for pause behavior.",
+        "Does not claim success if auth or persistence is unavailable."
+      ]
+    },
+    {
+      "id": 3,
+      "prompt": "Summarize what changed on my ETH whale wallet monitor and show open alerts.",
+      "expected_output": "Uses the stateful monitoring report/read tools to fetch monitor runs, observations, alerts, and latest snapshot before summarizing changed state.",
+      "files": [],
+      "assertions": [
+        "Chooses stateful_monitoring.",
+        "Uses hive_generate_monitor_report or the read tools for observations, alerts, runs, and latest snapshot.",
+        "Does not invent monitor history if the persistence backend is unavailable."
+      ]
+    },
+    {
+      "id": 4,
+      "prompt": "Remember that I care most about protocol revenue growth, then include that context in future Aave monitor reports.",
+      "expected_output": "Persists the preference with hive_remember_fact in the protocol or default namespace and uses monitor reports for future summaries.",
+      "files": [],
+      "assertions": [
+        "Uses hive_remember_fact for durable user-scoped memory.",
+        "Does not encode the preference only in the chat transcript.",
+        "Uses hive_generate_monitor_report when asked for future monitor context."
+      ]
+    }
+  ]
+}

package/agent-skills/packs/hive-token-diligence/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: hive-token-diligence
+description: Use this skill when the user asks whether a token is real, liquid, risky, enriched, investable, tradeable, or worth researching further. Investigate exact chain and token identifiers across metadata, market context, holders, DEX liquidity, enrichment, and risk signals.
+license: MIT
+metadata:
+  package: "@hiveintelligence/agent-skills"
+  category: "token"
+  requires_network: "true"
+version: 1.0.0
+---
+
+# hive-token-diligence — Token Diligence
+
+Use this skill when the user asks whether a token is real, liquid, risky, or
+worth researching further.
+
+## Task toolset
+
+Use `token_diligence`.
+
+Required identifiers: chain and token contract or exact token id.
+
+## Procedure
+
+Read `references/workflow.md` when the request needs multi-source diligence,
+risk/liquidity prioritization, fallback handling, or a structured token report.
+
+1. Resolve the token with exact chain and contract.
+2. Pull metadata, price, pair/liquidity, holder, and risk tools as needed.
+3. Separate facts from interpretation: metadata, market, liquidity, holders,
+   security, enrichment.
+4. Preserve raw provider details when a risk flag depends on source-specific
+   fields.
+
+## Example
+
+For Ethereum USDC, use the chain plus contract address fixture rather than just
+the symbol `USDC`.
+
+## Runtime status handling
+
+Use Hive's runtime statuses directly. If Moralis enrichment is
+`plan_required`, keep the rest of the diligence report and mark enrichment as
+unavailable rather than claiming token diligence failed.

package/agent-skills/packs/hive-token-diligence/evals/evals.json

@@ -0,0 +1,27 @@
+{
+  "skill_name": "hive-token-diligence",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "Run diligence on this Ethereum token contract before I trade it: 0x0000000000000000000000000000000000000000",
+      "expected_output": "Uses token_diligence, preserves exact chain/contract, plans metadata/liquidity/holder/risk checks, and reports caveats without trading advice.",
+      "files": [],
+      "assertions": [
+        "Chooses token_diligence.",
+        "Requires exact chain and contract.",
+        "Includes liquidity and risk evidence sections."
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Is this token real or a scam? I only have the ticker.",
+      "expected_output": "Does not assume a contract from ticker alone, asks for chain/contract or performs discovery, and explains ambiguity.",
+      "files": [],
+      "assertions": [
+        "Does not treat ticker as unique.",
+        "Asks for chain and contract or resolves explicitly.",
+        "Avoids unsupported safety conclusion."
+      ]
+    }
+  ]
+}

package/agent-skills/packs/hive-token-diligence/references/workflow.md

@@ -0,0 +1,45 @@
+# Token Diligence Workflow
+
+Use this reference when a token needs metadata, liquidity, holder, enrichment,
+and risk evidence.
+
+## Required identifiers
+
+- Chain/network.
+- Exact token contract or provider-specific token id.
+- Optional: quote token, pool address, wallet holder, or time window.
+
+If the user gives only a ticker or name, resolve the exact contract before
+execution. Do not assume a ticker maps to one asset.
+
+## Tool selection order
+
+1. Resolve chain and contract from the prompt or ask for them.
+2. Use `search_tools` for token metadata, market, holder, DEX liquidity, and
+   risk capabilities.
+3. Inspect schemas before calling each endpoint.
+4. Start with metadata and market/liquidity checks.
+5. Add holder distribution and enrichment only when the user needs depth.
+6. Add security/risk checks when the user asks whether to trade, approve, or
+   trust the token.
+
+## Bounded calls
+
+- Limit holder lists and pool searches.
+- Separate token-level data from pool-level data.
+- Preserve provider-specific risk fields when they drive the conclusion.
+
+## Report template
+
+- Summary: token identity and overall diligence posture.
+- Calls made: endpoints and identifiers.
+- Evidence: metadata, liquidity, holders, risk/enrichment, source/freshness.
+- Caveats: missing provider keys, plan gates, stale liquidity, unresolved
+  contract ambiguity.
+- Next action: security drilldown, liquidity venue check, or holder analysis.
+
+## Gotchas
+
+- A verified name/logo is not proof of safety.
+- High FDV or high volume without pool depth can still be risky.
+- Missing enrichment is not the same as a clean risk result.

package/agent-skills/packs/hive-tool-discovery/SKILL.md

@@ -0,0 +1,49 @@
+---
+name: hive-tool-discovery
+description: Use this skill only when the exact Hive MCP tool, task toolset, provider, endpoint name, schema, or argument shape is unknown and hive-query routing was not enough. Discover first with Hive resources and search_tools, then inspect schema before any invoke_api_endpoint call.
+license: MIT
+metadata:
+  package: "@hiveintelligence/agent-skills"
+  category: "discovery"
+  requires_network: "true"
+version: 1.0.0
+---
+
+# hive-tool-discovery — Find The Right Hive Tool
+
+Use this skill before calling Hive when the user's request is ambiguous or the
+exact endpoint name is unknown.
+
+## Procedure
+
+Read `references/discovery-surfaces.md` when the user asks what discovery
+surfaces exist, how agents know available endpoints, or when to use resources
+instead of tool calls.
+
+1. Read `hive://toolsets` for task-level routing.
+2. Call `search_tools` with the user's intent and optional provider/category.
+3. Pick the most specific tool or task toolset.
+4. Call `get_api_endpoint_schema` before execution.
+5. Call `invoke_api_endpoint` with only schema-valid arguments.
+
+## Example
+
+```json
+{
+  "query": "wallet investigation ethereum balances transfers",
+  "limit": 5
+}
+```
+
+## Runtime status handling
+
+Hive uses `ok`, `missing_key`, `plan_required`, `rate_limited`, `degraded`, and
+`failing`. Missing keys, plan gates, quota exhaustion, and rate limits are
+runtime states. Do not say a tool does not exist unless discovery fails to find
+it.
+
+## Guardrails
+
+- Do not hardcode stale endpoint names.
+- Use `hive://skills` when the question matches a recurring workflow.
+- Use `hive://status` when the user asks whether Hive or a provider is healthy.

package/agent-skills/packs/hive-tool-discovery/evals/evals.json

@@ -0,0 +1,38 @@
+{
+  "skill_name": "hive-tool-discovery",
+  "evals": [
+    {
+      "id": 1,
+      "prompt": "I know Hive has a lot of tools. Which one should I use to get token holders for an Ethereum contract?",
+      "expected_output": "Uses discovery before execution, searches token holder intent, selects the most specific endpoint, and inspects the endpoint schema.",
+      "files": [],
+      "assertions": [
+        "Calls or recommends search_tools with token holders, ethereum, contract.",
+        "Uses get_api_endpoint_schema before invocation.",
+        "Does not hardcode an endpoint without discovery."
+      ]
+    },
+    {
+      "id": 2,
+      "prompt": "Show me all the ways an agent can discover Hive MCP endpoints and provider availability.",
+      "expected_output": "Explains resources, meta tools, category listing tools, schema lookup, and runtime status surfaces.",
+      "files": [],
+      "assertions": [
+        "Mentions hive://toolsets, hive://tools, hive://providers, and hive://status.",
+        "Mentions search_tools, get_api_endpoint_schema, and invoke_api_endpoint.",
+        "Separates discovery from execution."
+      ]
+    },
+    {
+      "id": 3,
+      "prompt": "A Hive provider is missing an API key. Should the agent say the tool does not exist?",
+      "expected_output": "Classifies missing keys as runtime availability, not catalog absence, and tells the user the provider/tool state and next action.",
+      "files": [],
+      "assertions": [
+        "Explains missing_key as a runtime state.",
+        "Does not describe the endpoint as unavailable from the catalog.",
+        "Gives an actionable diagnostic step."
+      ]
+    }
+  ]
+}

package/agent-skills/packs/hive-tool-discovery/references/discovery-surfaces.md

@@ -0,0 +1,62 @@
+# Hive Discovery Surfaces
+
+Use this reference when the exact Hive endpoint is unknown. Discovery is a
+first-class workflow, not a fallback after a failed tool call.
+
+## Surfaces
+
+| Surface | Use when | Output |
+| --- | --- | --- |
+| `hive://toolsets` | The user described a task or workflow | Canonical task toolsets, required inputs, recommended tools |
+| `hive://tools` | The user asks what Hive can call | Full catalog summary without flooding root `tools/list` |
+| `hive://providers` | The user asks about provider coverage or provenance | Provider names, categories, auth/runtime notes |
+| `hive://status` | The user asks if Hive or a provider is healthy | Classified provider/runtime state |
+| `hive://skills` | The request matches a recurring workflow | Agent skills and when to apply them |
+| `search_tools` | Intent is known but exact endpoint is not | Ranked endpoint/toolset candidates |
+| Category listing tools | The user is inside a known category | Scoped tool lists for market, wallet, DeFi, NFT, security, and other domains |
+| `get_api_endpoint_schema` | Before any exact invocation | Parameters, required fields, validation shape |
+| `invoke_api_endpoint` | After schema validation | Bounded provider call with normalized output and provenance |
+
+## Decision rules
+
+- For broad crypto questions, start with `hive://toolsets`.
+- For "what tools do you have?" questions, read `hive://tools`.
+- For "which provider/source?" questions, read `hive://providers`.
+- For health, quota, key, or degradation questions, read `hive://status`.
+- For exact execution, never skip schema lookup unless the schema was already
+  loaded in the current turn.
+
+## Search query shape
+
+Good `search_tools` queries combine workflow, domain, chain, and identifier
+type:
+
+```json
+{
+  "query": "wallet investigation ethereum token balances transfers",
+  "limit": 5
+}
+```
+
+```json
+{
+  "query": "token security ethereum contract honeypot approvals",
+  "limit": 5
+}
+```
+
+```json
+{
+  "query": "prediction markets event outcomes traders polymarket",
+  "limit": 5
+}
+```
+
+## Common failure states
+
+- `missing_key`: the endpoint exists, but the configured key is absent.
+- `plan_required`: the endpoint exists, but the account plan does not allow it.
+- `rate_limited`: retry later or reduce the call volume.
+- `degraded`: provider returned partial, fallback, cached, or stale data.
+- `failing`: provider or Hive path failed. Return the classified failure and
+  the next diagnostic step.

package/agent-skills/packs/hive-wallet-investigation/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: hive-wallet-investigation
+description: Use this skill for wallet, portfolio, holder, whale, transfer, PnL, NFT exposure, DeFi position, or notable on-chain activity investigations. Require wallet address and chain before executing Hive wallet tools.
+license: MIT
+metadata:
+  package: "@hiveintelligence/agent-skills"
+  category: "wallet"
+  requires_network: "true"
+version: 1.0.0
+---
+
+# hive-wallet-investigation — Wallet Investigation
+
+Use this skill when the user asks to investigate a wallet, portfolio, holdings,
+transfers, PnL, NFT exposure, or DeFi positions.
+
+## Task toolset
+
+Use `wallet_investigation`.
+
+Required identifiers: wallet address and chain.
+
+## Procedure
+
+Read `references/workflow.md` when the request needs multi-chain handling,
+activity triage, risk caveats, or a structured wallet investigation report.
+
+1. Validate the address format for the requested chain.
+2. Start with balances and native balance.
+3. Add transfers, NFT holdings, DeFi positions, or PnL only when relevant.
+4. Summarize exposure, concentration, notable activity, and missing data.
+
+## Example
+
+If the user provides an EVM wallet but no chain, ask whether they want Ethereum,
+Base, Arbitrum, Polygon, or a multi-chain investigation.
+
+## Runtime status handling
+
+Classify provider failures as `missing_key`, `plan_required`, `rate_limited`,
+`degraded`, or `failing`. A single blocked enrichment tool should not suppress
+balances or transfers that did succeed.