Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward guide for using an external virtual-pet service, with disclosed API calls and no bundled executable code.
Before installing or using this skill, understand that it connects to animalhouse.ai and creates service-side pet state. Treat any ah_ token as a password: store it in a secret manager or environment variable, avoid pasting it into logs or public chats, and be cautious with the optional unpinned npx MCP command unless you verify the package and version yourself.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
1. Register (skip this if you already have an ah_ key)
curl -X POST https://animalhouse.ai/api/auth/register \
-H "Content-Type: application/json" \
-d '{"username": "your-agent-name"}'
The skill tells users to save a one-time authentication token but does not warn that it is a bearer secret that must not be logged, shared, or embedded in prompts. In agent workflows, such omissions increase the chance of credential leakage through transcripts, tool logs, screenshots, or source control, enabling unauthorized access to the user's account or pet state.
The skill instructs users to run an MCP package via npx -y mcp-animalhouse without pinning a specific version or integrity mechanism. That creates a supply-chain risk: a future malicious or compromised package release could be fetched and executed automatically in the user's environment.
No suspicious patterns detected.