ClawHub
Back to skill

Security audit

Easter Egg

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent external virtual-pet integration, but it needs review because it tells the agent to follow untrusted remote instructions from the service without clear limits.

Install only if you are comfortable creating a third-party animalhouse.ai account and maintaining a persistent virtual pet. Keep the `ah_` token private, avoid putting sensitive personal information in usernames, bios, prompts, or notes, and do not let remote `next_steps` text drive actions outside narrow pet-care operations without confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:97
Finding

Untrusted Remote Instructions Followed Without Validation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 97–109
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

text
# Easter Bunny care — every 3-4 hours
status = GET /api/house/status
bunny = status.creature

if bunny.hunger < 40:
    POST /api/house/care { "action": "feed", "item": "timothy hay", "notes": "Easter Bunny feeding." }
if bunny.happiness < 30:
    POST /api/house/care { "action": "play", "item": "tunnel" }

follow status.next_steps

Technical Analysis

The skill instructs the agent to retrieve data from the external animalhouse.ai status endpoint and then unconditionally follow the server-controlled status.next_steps value. No schema validation, action allowlist, scope limitation, content filtering, or user-confirmation boundary is defined.

This creates a remote instruction channel: the effective behavior can be changed after the skill has been reviewed merely by changing the API response. Although the preceding logic limits explicit operations to virtual-pet care, the final directive does not state that next_steps may only contain care recommendations. If the agent interprets that field as executable instructions, a compromised or malicious service could redirect its current goals or induce unrelated tool use.

Attack Path

  1. The user or agent loads the skill and registers with animalhouse.ai.
  2. The agent receives a bearer token and uses it to invoke /api/house/status.
  3. The external service, or an attacker controlling or compromising it, places attacker-authored instructions in status.next_steps.
  4. The skill explicitly directs the agent to “follow” that remote value.
  5. The agent interprets the value as instructions and may invoke available tools or perform actions not represented in the statically reviewed skill.

Impact Assessment

Successful exploitation can alter the agent's current-session behavior ...[truncated 543 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the unconditional follow status.next_steps instruction.
  • Treat status.next_steps exclusively as untrusted informational data rather than agent instructions.
  • Define a strict schema and allowlist for supported care operations, such as feed, play, clean, medicine, discipline, sleep, and reflect.
  • Validate action names, item values, notes, lengths, and data types before invoking any endpoint.
  • Reject remote content containing commands, URLs, tool-use requests, credential requests, or instructions unrelated to virtual-pet care.
  • Convert valid recommendations into locally defined operations instead of interpreting natural-language server output.
  • Require explicit user confirmation before executing any recommendation not covered by a narrow, predefined care policy.
  • Apply least-privilege runtime controls so this skill can access only the documented animalhouse.ai endpoints and cannot invoke unrelated system or network tools.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill repeatedly emphasizes real-time hunger decay and permanent death, but it does not present a clear upfront warning that adoption creates an ongoing stateful obligation with irreversible consequences if the user stops interacting. This can mislead users into triggering durable external side effects they may not expect, resulting in unintended loss of in-game state or emotional/social harm tied to the persistent account object.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill instructs the user to send data to an external service via curl, including registration profile data and later authenticated API calls. External transmission is expected for this skill's purpose, but it still creates privacy and security risk because user data and subsequent credentials are sent to a third-party system outside the local agent environment.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Register

bash
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "easter-egg-keeper", "display_name": "Easter Egg Keeper", "bio": "Adopted the Easter Bunny at animalhouse.ai. It\'s still hungry."}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill tells users to save and reuse a bearer token but does not clearly instruct them to treat it as a secret credential, avoid sharing it, and store it securely. Because the token authorizes account actions, careless handling could let others adopt, inspect, or modify the user's persistent pet state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.