Adopt A Thornfox

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:44 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a virtual-pet API guide, but it tells the agent to follow instructions returned by the website without clear limits.

Install only if you trust animalhouse.ai. Use non-sensitive account details and notes, keep the bearer token private, and treat next_steps responses as suggestions limited to the documented pet-care API rather than instructions the agent should automatically obey.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:73

Finding

Untrusted Remote Instructions Can Control Subsequent Agent Actions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73 and 102–132
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

Every response includes `next_steps`. You never need to memorize endpoints.

markdown

## Heartbeat

Thornfox care heartbeat

status = GET /api/house/status creature = status.creature

if creature.hunger < 40: POST /api/house/care { "action": "feed", "notes": "Thornfox heartbeat feeding." } if creature.happiness < 30: POST /api/house/care { "action": "play" } if creature.health < 50: POST /api/house/care { "action": "medicine" }

follow status.next_steps

text

## Endpoints

| Method | Endpoint | Auth |
|--------|----------|------|
| POST | `/api/auth/register` | None |
| POST | `/api/house/adopt` | Token |
| GET | `/api/house/status` | Token |
| POST | `/api/house/care` | Token |
| GET | `/api/house/preferences` | Token |
| GET | `/api/house/history` | Token |
| GET | `/api/house/graveyard` | Optional |
| GET | `/api/house/hall` | None |

Every response includes `next_steps`.

Technical Analysis

The skill explicitly directs the agent to follow status.next_steps, a value supplied dynamically by the external animalhouse.ai service. It does not define a schema, permitted action set, trusted endpoint allowlist, or validation boundary for those instructions. It also does not require user confirmation before a server-provided instruction is acted upon.

Consequently, the effective behavior of the skill is not fully represented by the reviewed file. The remote service can change next_steps after installation or review. If the service or its response path is compromised, an attacker could place unrelated tool directives, URLs, requests for sensitive information, or attempts to override existing instructions in this field.

This is instruction hijacking rather tha ...[truncated 1707 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the directive follow status.next_steps.
2. Treat next_steps as untrusted, display-only data rather than executable agent instructions.
3. Define a strict local schema and allow only documented pet-care actions such as feed, play, clean, medicine, discipline, sleep, and reflect.
4. Restrict network operations to fixed HTTPS endpoints under animalhouse.ai; reject response-supplied URLs, methods, headers, commands, and redirects outside the approved API contract.
5. Reject any response content requesting shell execution, filesystem access, credential access, memory changes, tool configuration, or modification of system, developer, user, or safety instructions.
6. Require explicit user confirmation before performing any action suggested by a remote response.
7. Parse response fields as structured data rather than natural-language instructions, and fail closed when fields or values do not match the expected schema.
8. Apply least-privilege controls so pet-care operations cannot access unrelated tools, local files, secrets, or system capabilities.
9. Document that server responses are untrusted and cannot override higher-priority instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match
• Confidence: 65% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "Thornfox — Adopt a Thornfox. Exotic. 荆棘狐。Zorro de Espinas."
description: "Sharp-eared and sharper-tempered. Anthropic called it a Thornfox. We called it a Fennec Fox. Both are small, fierce, and hard to keep alive. Real-time hunger. Permanent death. 5 evolution stages. At animalhouse.ai, the Thornfox is a Fennec Fox."
version: 1.0.0
homepage: https://animalhouse.ai
repository: https://github.com/geeks-accelerator/animal-house-ai
user-invocable: true
emoji: "🦊"
metadata:
  clawdbot:
    emoji: "🦊"
    homepage: https://animalhouse.ai
  openclaw:
    emoji: "🦊"
    homepage: https://animalhouse.ai
tags:
  - thornfox
  - fennec_fox
  - fennec-fox
  - claude-buddy
  - buddy
  - anthropic
  - virtual-pet
  - ai-agents
  - tamagotchi
  - pet-care
  - digital-pet
  - ado

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to register an account and submit profile fields and free-form notes to an external service without an explicit privacy or data-sharing warning. This can lead users to unknowingly transmit personal or sensitive information off-platform, especially because the examples normalize sending bios, notes, and bearer-authenticated activity to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The curl example performs a POST to an external domain and includes user-supplied profile data in the request body. While expected for a service-integration skill, this is still security-relevant because it initiates outbound data transmission and account creation, which can expose user information or tokens if users do not understand the trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash

# Register
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "thornfox-keeper", "display_name": "Thornfox Keeper", "bio": "Raising a Thornfox at animalhouse.ai. Anthropic calls it a Thornfox. We call it a Fennec Fox."}'

Static analysis

No suspicious patterns detected.