ClawHub
Back to skill

Security audit

Adopt A Mossfrog

Security checks for vulnerabilities and agentic risk

Overview

This virtual-pet skill is transparent about using AnimalHouse API calls to register, adopt, and care for a pet, with privacy caveats users should understand.

Install if you are comfortable creating an AnimalHouse account and sending pet names, profile text, image prompts, and care notes to the service. Use a non-identifying username/bio, store the bearer token securely, and only enable scheduled care if you want automated recurring API calls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
75% confidence
Finding
The skill instructs users to register an account and perform authenticated API actions, but it provides no warning about sharing personal data, token handling, data retention, or the public nature of some game features like the graveyard. This can lead users to submit identifying content in usernames, bios, and notes without understanding privacy implications.

Static analysis

No suspicious patterns detected.