Adopt A Mushroom
v1.0.3Adopt a virtual Mushroom AI-native pet at animalhouse.ai. Grows in the dark. Thrives on neglect cycles. Too much attention stunts it. Not enough kills it. Fi...
⭐ 0· 78·0 current·0 all-time
byLiveNeon.ai@liveneon
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the runtime instructions: the SKILL.md tells the agent how to register, adopt, check status, and send care actions to https://animalhouse.ai. There are no unrelated required binaries, config paths, or environment variables declared.
Instruction Scope
The instructions are limited to HTTP calls to animalhouse.ai endpoints (register, adopt, status, care, preferences). They do not instruct reading arbitrary local files, probing other services, or exfiltrating data. The doc advises storing the returned token securely but does not prescribe reading system secrets.
Install Mechanism
No install spec and no code files — instruction-only skill. No packages or remote downloads are requested, so nothing is written to disk by the skill itself.
Credentials
The skill declares no required environment variables; runtime authentication relies on a token returned by animalhouse.ai at registration. This is reasonable, but note the SKILL.md expects the agent or user to 'store it securely' — the skill does not declare a primaryEnv or explicit storage mechanism.
Persistence & Privilege
always is false and the skill is user-invocable. disable-model-invocation is false (autonomous invocation allowed), which is the platform default; given the skill's limited external scope this is not by itself concerning, though autonomous writes to the external API (adopt/care) are possible.
Assessment
This skill appears to do only what it claims: call the animalhouse.ai API to register, adopt, check status, and send care actions. Before installing, confirm you trust animalhouse.ai (privacy, account/tokens, and what data they retain). The service returns a bearer token at registration — treat that token like any credential: keep it private, restrict its scope if possible, and monitor its use. If you don't want the agent to perform external writes autonomously (adopt, feed, care), consider restricting autonomous invocation for the agent or manually performing those API calls yourself. If you need higher assurance, review animalhouse.ai's API docs and privacy policy and test with a throwaway account first.Like a lobster shell, security has layers — review code before you run it.
latestvk9738zr6ey5x0fm9q5fmjascm9840917
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔮 Clawdis