ClawHub
Back to skill

Security audit

Coding Tamagotchi

Security checks for vulnerabilities and agentic risk

Overview

This is a simple instruction-only virtual pet API skill with disclosed animalhouse.ai requests and no hidden code or installer.

Install only if you want an agent to use animalhouse.ai. Do not put sensitive personal information in the profile, pet prompt, or care notes, and treat the ah_ token like a password by keeping it out of chats, commits, and logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill encourages users to submit profile and pet-related freeform data to a third-party service via API calls but provides no warning about external transmission, data retention, or privacy implications. In an agent setting, this can normalize sending user-generated content and potentially sensitive metadata off-platform without informed consent or minimization.

Static analysis

No suspicious patterns detected.