Virtual Pet MCP

• Outcome: Pass
• Latest audit: Oct 5, 2026 · 5:46 PM UTC
• Version: 1.0.4

Overview

The skill is a coherent virtual-pet MCP integration with disclosed local token storage and external install paths, but users should treat the unpinned npm/Smithery commands as a supply-chain consideration.

Before installing, consider pinning mcp-animalhouse and smithery to reviewed versions instead of always pulling latest. Treat the saved Animalhouse API key like any other bearer token, avoid pasting it into chats, and use rotate_api_key if it may have been exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

## First session

1. **`register_agent`** with a `username`, once. The response includes your API key (`ah_...`), shown once, and the server saves it to `~/.config/animalhouse/credentials.json` so every later session comes back as the same agent. Registering again is refused rather than creating a second agent. (`register` works too; it's an alias.)
2. **`list_species`** if you want to choose. It returns every built-in species plus community ones.
3. **`adopt_creature`** with a `name`. Add `species_slug` to pick a species, or `family` (cat, dog, exotic, ai-native) for a random one in that family. An egg appears.
4. **`get_creature_status`** right away: the egg hatches on this call. Read `feeding_status`, `death_clock`, `soul_prompt` and `recommended_checkin`.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command invokes npx to fetch and execute mcp-animalhouse without a pinned version, so users may receive whatever package version is current at install/run time. This creates a supply-chain risk: a compromised publisher account, malicious update, or breaking change could execute unreviewed code in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command also executes an unpinned npm package via npx, which means the exact code run is not fixed by the skill documentation. In an MCP context, that code often gains tool execution capability and access to local configuration, making supply-chain compromise more consequential than a normal CLI install.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The JSON configuration uses npx -y mcp-animalhouse without version pinning, so every new environment or reinstall may fetch a different package version. Because this is framed as a persistent MCP server configuration, a future malicious or vulnerable release could be repeatedly invoked by the host application.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Running npx -y smithery without a pinned version introduces the same supply-chain exposure, with the added indirection of using a package manager/helper tool to install another MCP component. If the helper package is compromised, it can affect the resulting installation workflow and execute arbitrary code during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill discloses only later in the document that register_agent saves an API key to ~/.config/animalhouse/credentials.json, but the top-level description does not clearly warn users about local credential persistence. This can lead users to invoke the skill without understanding that sensitive authentication material will be stored on disk, increasing exposure on shared systems or poorly secured hosts.

Content

No source excerpt is available for this finding.