ClawHub
Back to skill

Security audit

Adopt A Blob

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent virtual-pet API skill, with minor cautions around token handling, optional scheduled care, and an underexplained release/delete endpoint.

Before installing, be comfortable giving the agent an animalhouse.ai token and allowing it to make pet-care API calls. Keep any release/delete action under explicit human confirmation, and only enable scheduled care if you want recurring background requests to the service.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill documents a destructive DELETE `/api/house/release` endpoint without explaining whether the action is irreversible, what data or pet state is lost, or whether confirmation safeguards exist. In an agent context, this omission increases the chance that an automated system or user invokes a destructive operation unintentionally, causing permanent loss of the adopted creature or associated progress.

Static analysis

No suspicious patterns detected.