宠物冒险生活

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed local pet-diary simulation with limited weather lookup and workspace files, not evidence of hidden or harmful behavior.

Install only if you want a persistent text pet diary in a chosen workspace. Expect a `pet-life/` folder with diary and state files, and use `--offline` if you do not want weather requests to Open-Meteo.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises commands that invoke local Python scripts with workspace writes, shell execution, and likely network-backed weather/location features, but it declares no explicit tool scope or permission boundaries. This can cause an agent platform to expose broader capabilities than the user expects, increasing the chance of unintended filesystem modification, command execution, or outbound requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description uses broad activation phrasing like creating, running, advancing, checking, handling, and growing a simulation, which could match routine requests about pets, diaries, travel, or status updates. Over-broad triggering raises the risk that the skill is invoked in contexts where the user did not intend persistent writes, external data access, or autonomous state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description highlights real-world location, local time, weather, and emergency phone/notification behavior but does not clearly disclose that external data sources or notification channels may be used. This can expose user context or workspace-linked activity to third-party services and surprise users with outbound communication behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that it creates a pet-life/ folder in the user's workspace and later writes multiple persistent state, log, and diary files, but it does not prominently warn about this data persistence before use. Users may unknowingly allow durable storage of potentially sensitive location, behavior, or diary data in their project directory.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default prompt uses a very generic activation phrase, "Use $pet-adventure-life to initialize or advance my pet adventure diary," without clear constraints on when the skill should be invoked. Broad triggers increase the chance of unintended activation in unrelated conversations, which can cause the agent to access location, time, weather, or calling behaviors when the user did not explicitly intend that workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The title and framing indicate the skill is specifically operating in Chinese, but the file does not offer a user language choice or explain that the locale restriction is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openclaw_adapter.py (reported line 41)May include surrounding context.

python

cmd.append(flag)
        else:
            cmd.extend([flag, str(value)])
    completed = subprocess.run(cmd, capture_output=True, text=True, check=False)
    if completed.returncode != 0:
        return {
            "ok": False,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code defines core user-visible content such as species names, personality names, and narrative voice strings entirely in Chinese, and the rest of the CLI output and diary content is also emitted in Chinese. Because the file does not offer user opt-in, language selection, or a documented region-specific justification, it violates the natural-language locale policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends location and timezone data to a third-party weather service without any explicit disclosure or consent flow. Even though the coordinates come from a fixed in-code location list rather than direct GPS input, this still creates an external data transmission path and may surprise users in a diary-style skill that appears local-only.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This code performs an outbound HTTPS request to open-meteo.com, transmitting latitude, longitude, current weather query fields, and timezone. In context this is functional rather than overtly malicious, but the lack of transparency and consent makes the external transmission a real privacy-relevant issue for a skill centered on user-driven world state and travel simulation.

Content

Scanner excerpt · scripts/pet_adventure.py (reported line 235)May include surrounding context.

python

"timezone": location["timezone"],
        }
    )
    url = f"https://api.open-meteo.com/v1/forecast?{query}"
    try:
        with urllib.request.urlopen(url, timeout=8) as response:
            payload = json.loads(response.read().decode("utf-8"))

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_pet_adventure.py (reported line 18)May include surrounding context.

python

def run(workspace: Path, *args: str) -> dict:
    cmd = [sys.executable, str(ENGINE), "--workspace", str(workspace), *args]
    completed = subprocess.run(cmd, capture_output=True, text=True, check=True)
    return json.loads(completed.stdout)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_pet_adventure.py (reported line 54)May include surrounding context.

python

resolved = run(workspace, "auto-resolve")
        assert resolved["resolved"], "expected expired urgent call to resolve"
        payload = json.dumps({"workspace": str(workspace)})
        completed = subprocess.run(
            [sys.executable, str(ADAPTER), "status", "--payload", payload],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction 'Keep user-facing prose in Chinese unless the user asks otherwise' imposes a default language choice before the user opts in. This is a natural-language locale policy concern because it forces a specific language unless the user actively overrides it.

Content

No source excerpt is available for this finding.