Anthropic Buddy
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the examples can create an Animal House account and change a pet's state on a third-party service.
The skill documents remote API calls that create an account, adopt a pet, and mutate pet state. This is disclosed and aligned with the virtual-pet purpose, but it is still external state-changing activity.
curl -X POST https://animalhouse.ai/api/auth/register ... /api/house/adopt ... /api/house/care
Only run these API calls after the user confirms they want to register, adopt, or care for a pet on animalhouse.ai.
Anyone with the token may be able to access or modify the user's Animal House pet/account state.
The skill uses an Animal House bearer token generated during registration. This is expected for the integration, but it is an account credential even though the registry metadata declares no primary credential.
Save `your_token`. Starts with `ah_`. Shown once. ... Authorization: Bearer YOUR_TOKEN
Keep the token private, avoid pasting it into unrelated chats or logs, and rotate or revoke it if the service offers that option.
A user might incorrectly assume the service is officially associated with Anthropic or Claude Code.
The skill uses Anthropic/Claude/leak phrasing while directing users to animalhouse.ai, a third-party site. The April Fools-style tags make this look promotional, but the wording could still create mistaken trust.
Anthropic's Buddy leaked from Claude Code. ... **animalhouse.ai**
Treat this as a third-party animalhouse.ai integration and verify the service and repository before creating an account.