Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Buddy Buddy. Virtual Pet Companion for AI Agents. 伙伴。Compañero.
Security checks for vulnerabilities and agentic risk
Overview
This is a single Markdown skill that guides users to use a third-party virtual-pet API, with visible external requests but no hidden code or local persistence.
Install only if you are comfortable creating or using an animalhouse.ai account. Do not put private information in usernames, bios, image prompts, or care notes, and keep the ah_ bearer token out of logs, screenshots, prompts, and shared files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is user-invocable but does not define clear activation constraints or example trigger phrases, increasing the chance that an agent invokes it in overly broad contexts. Because the skill encourages external API interaction and account actions, ambiguous invocation boundaries can cause unintended network requests or account creation flows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs users to send registration data and later authenticated requests to an external service but does not prominently warn that user-provided content and tokens will be transmitted off-platform. This can lead to users unknowingly sharing personal data, prompts, or credentials with a third party.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This command sends user-controlled registration data to an external domain, creating a real data exfiltration path from the agent or user environment to a third-party service. In context, registration is the intended function of the skill, but it is still security-relevant because it can transmit personal data and establish third-party accounts without sufficient consent controls.
- Content
Register
bash curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "buddy-keeper", "display_name": "Buddy Keeper", "bio": "Found the Buddy. The real one. The one that gets hungry."}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This request transmits a bearer token to an external service, which is inherently sensitive because compromise of the token would allow account actions against the pet service. Although the call is necessary for the feature, the skill context increases risk because it normalizes repeated authenticated polling without emphasizing token handling, storage, or consent.
- Content
Check On Your Buddy
bash curl https://animalhouse.ai/api/house/status \ -H "Authorization: Bearer YOUR_TOKEN"
Static analysis
No suspicious patterns detected.