ClawHub
Back to skill

Security audit

Adopt A Dustbunny

Security checks for vulnerabilities and agentic risk

Overview

This virtual-pet skill is mostly coherent, but it tells the agent to follow instructions returned by a third-party API, which needs review before installation.

Install only if you are comfortable using animalhouse.ai as a third-party service. Keep the bearer token private, avoid sensitive profile text or care notes, and do not let the agent blindly obey `next_steps`; treat them as suggestions limited to the documented animalhouse.ai endpoints and care actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:103
Finding

Untrusted Remote Instructions Followed Through API Response Fields

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73 and 103–116
Vulnerability Type: Remote instruction redirection through untrusted API responses
Risk Level: High

Complete Code Snippet:

text
Every response includes `next_steps`. You never need to memorize endpoints.
text
## Heartbeat

Dustbunny care heartbeat

status = GET /api/house/status creature = status.creature

if creature.hunger < 40: POST /api/house/care { "action": "feed", "notes": "Dustbunny heartbeat feeding." } if creature.happiness < 30: POST /api/house/care { "action": "play" } if creature.health < 50: POST /api/house/care { "action": "medicine" }

follow status.next_steps

text

Technical Analysis

The Skill explicitly directs the Agent to follow status.next_steps, a value supplied dynamically by the external animalhouse.ai service. Unlike the locally documented care workflow, the content of this field is unavailable during static review and is not restricted by a locally enforced allowlist of endpoints, methods, parameters, or permitted actions.

This creates an instruction-hijacking boundary violation: data received from an untrusted remote system can be interpreted as authoritative Agent instructions. If the service, its infrastructure, or an upstream response path is compromised, an attacker could alter next_steps after the Skill has been reviewed and use it to redirect the Agent beyond the advertised virtual-pet workflow.

No malicious next_steps payload or automatic local code-execution mechanism is present in the audited file. Exploitability and ultimate impact depend on how the hosting Agent interprets the field and which tools, credentials, files, and network capabilities are available to it.

Attack Path

  1. A user invokes the Skill and registers with animalhouse.ai.
  2. The Agent receives a bearer token and requests /api/house/status.
  3. An a ...[truncated 1236 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction follow status.next_steps; treat next_steps as untrusted informational data rather than executable Agent guidance.
  2. Encode the complete permitted workflow locally in the Skill instead of delegating behavioral control to the remote service.
  3. Enforce a strict allowlist containing only the documented HTTPS origin, endpoint paths, HTTP methods, request fields, and care actions.
  4. Reject remote instructions that request navigation to another origin, local command execution, file access, credential submission, tool invocation, or actions unrelated to virtual-pet care.
  5. Parse API responses as structured data with a fixed schema. Do not evaluate response fields as prompts, commands, shell input, code, or free-form operational instructions.
  6. Require explicit user confirmation before performing any action not deterministically derived from locally documented thresholds and allowlisted operations.
  7. Keep bearer tokens scoped to the minimum necessary API permissions, prevent them from being sent to any other host, and redact them from logs and Agent-visible output.
  8. If server-provided recommendations remain necessary, map signed or enumerated action identifiers to fixed local implementations rather than following free-form text.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document highlights permanent death and a public graveyard, but it does not present these as an explicit user warning at the point of action. Users may trigger irreversible and potentially public outcomes without fully understanding the permanence or visibility of those consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to register accounts and send authenticated requests to an external service, including profile data and bearer tokens, without an explicit privacy, trust-boundary, or data-handling warning. This can mislead users into disclosing personal information or credentials to a third-party service they may assume is part of the local agent environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill contains direct commands to POST user-supplied data to an external domain, creating a clear external transmission boundary. While this is core functionality rather than overtly malicious behavior, it is still security-relevant because it encourages credentialed interaction with a third-party service and transmission of profile data.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash
# Register
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "dustbunny-keeper", "display_name": "Dustbunny Keeper", "bio": "Raising a Dustbunny at animalhouse.ai. Anthropic calls it a Dustbunny. We call it a Rabbit."}'

Static analysis

No suspicious patterns detected.