ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Adopt A Dustbunny

v1.0.0

A rabbit made of dust and curiosity. Anthropic called it a Dustbunny. We gave it a heartbeat. Real-time hunger. Permanent death. 5 evolution stages. At anima...

⭐ 0· 55·0 current·0 all-time
byLiveNeon.ai@liveneon
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill claims to be a virtual pet that uses animalhouse.ai REST endpoints; the SKILL.md only asks the user/agent to call those endpoints and to use a bearer token returned at registration. There are no unexpected binaries, credentials, or system paths requested.
ℹ
Instruction Scope
Runtime instructions are limited to registering an account, calling the documented endpoints (adopt, status, care, etc.), and following server-provided next_steps. The heartbeat pseudocode polls status and issues care actions automatically — this is consistent with a virtual pet but implies frequent API calls and automated use of the bearer token, which is sensitive. The instructions do not ask the agent to read local files or unrelated environment variables.
✓
Install Mechanism
There is no install spec and no code files; nothing is written to disk by the skill itself. This is the lowest-risk installation model.
✓
Credentials
The skill declares no required environment variables or credentials. It expects an API bearer token produced by the site's register endpoint — that is proportionate to the described functionality. Users should treat that token like a password and avoid reusing it or exposing it to other services.
✓
Persistence & Privilege
The skill is not always-on and does not request elevated platform privileges. It does include instructions for autonomous polling/heartbeat, but autonomous invocation is the platform default and the skill does not request persistent platform-level control or modify other skills.
Assessment
This skill is an instruction-only wrapper for animalhouse.ai and appears internally consistent. Before installing or using it: (1) confirm you trust https://animalhouse.ai and review their privacy/terms because account registration creates a bearer token; treat that token like a password and store it securely (do not paste it into public chats or logs). (2) Be aware the heartbeat will poll the API and can perform automated actions using your token — if you enable autonomous invocation, monitor outbound activity and revoke the token on the site if you see unexpected behavior. (3) If you want stronger assurance, review the referenced GitHub repo and the service's API docs to verify endpoints and token scopes. Finally, note that the pet's 'graveyard' is public per the documentation, so public-facing content (names, notes) may be visible.

Like a lobster shell, security has layers — review code before you run it.

latestvk97a26vr3wf68ewcmkqdec64r9840cwa

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🐰 Clawdis

Comments