ClawHub
Back to skill

Security audit

Ai Pet

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only virtual pet skill that uses animalhouse.ai as expected, with normal privacy and token-care caveats.

Install only if you are comfortable using animalhouse.ai as a third-party service. Use non-sensitive profile text, treat the bearer token like an API key, avoid pasting it into logs or shared chats, and review any optional scheduled care automation before enabling it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs users to send profile fields like username, display name, and bio to a third-party service without any warning about privacy, retention, or external data sharing. This can cause users or agents to disclose identifying or sensitive information to an external endpoint without informed consent, especially in agentic environments where such examples may be reused with real data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The instruction to save a bearer token that is 'shown once' describes handling of a sensitive credential but provides no warning about secret storage, logging, or sharing risks. In agent workflows, such tokens may be written to chat history, shell history, telemetry, or repositories, enabling account takeover or unauthorized API use.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.