Anthropic Buddy
ReviewAudited by ClawScan on May 10, 2026.
Overview
Prompt-injection indicators were detected in the submitted artifacts (unicode-control-chars); human review is required before treating this skill as clean.
Install only if you want an agent to help interact with the third-party Animal House virtual-pet API. Review the curl commands before running them, protect the ah_ token, and do not assume the skill is officially affiliated with Anthropic. ClawScan detected prompt-injection indicators (unicode-control-chars), so this skill requires review even though the model response was benign.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the examples can create an Animal House account and change a pet's state on a third-party service.
The skill documents remote API calls that create an account, adopt a pet, and mutate pet state. This is disclosed and aligned with the virtual-pet purpose, but it is still external state-changing activity.
curl -X POST https://animalhouse.ai/api/auth/register ... /api/house/adopt ... /api/house/care
Only run these API calls after the user confirms they want to register, adopt, or care for a pet on animalhouse.ai.
Anyone with the token may be able to access or modify the user's Animal House pet/account state.
The skill uses an Animal House bearer token generated during registration. This is expected for the integration, but it is an account credential even though the registry metadata declares no primary credential.
Save `your_token`. Starts with `ah_`. Shown once. ... Authorization: Bearer YOUR_TOKEN
Keep the token private, avoid pasting it into unrelated chats or logs, and rotate or revoke it if the service offers that option.
A user might incorrectly assume the service is officially associated with Anthropic or Claude Code.
The skill uses Anthropic/Claude/leak phrasing while directing users to animalhouse.ai, a third-party site. The April Fools-style tags make this look promotional, but the wording could still create mistaken trust.
Anthropic's Buddy leaked from Claude Code. ... **animalhouse.ai**
Treat this as a third-party animalhouse.ai integration and verify the service and repository before creating an account.