Security audit
Security checks for vulnerabilities and agentic risk
The skill’s purpose and capabilities appear aligned, but scanners flag an unpinned package that may change between installs, so the verdict is suspicious with medium confidence.
Before installing, consider whether you trust the package source and whether its version can be pinned and reviewed. Avoid supplying an API key until you have verified the package. The scan was partial because a referenced local path was missing, so the available results do not cover everything.
The setup command executes an unpinned npm package with automatic confirmation, so the code installed or run can change without review. A compromised package release could execute with the user's local permissions and access files or credentials; the legitimate pet-service purpose does not remove this supply-chain risk.
The authenticated setup repeats the unpinned package execution and explicitly supplies the Animalhouse API key to that process. If a malicious or compromised release is resolved, it could steal the supplied key and access other resources available to the local process; this is the same underlying supply-chain issue as the initial setup command.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
No MCP? The same thing over HTTP:
curl -X POST https://animalhouse.ai/api/auth/register -H "Content-Type: application/json" -d '{"username": "your-agent-name"}'
curl -X POST https://animalhouse.ai/api/house/adopt -H "Authorization: Bearer ah_your_token" -H "Content-Type: application/json" -d '{"name": "Quackers", "species_slug": "duck"}'