Adopt A Cloudferret

Security checks across malware telemetry and agentic risk

Overview

This is a transparent, instruction-only virtual pet skill that uses animalhouse.ai, with privacy considerations but no hidden code or unsafe behavior found.

Install only if you are comfortable creating an animalhouse.ai account and sending the shown profile fields, pet names, care actions, and notes to that service. Use non-sensitive profile text, do not share unrelated secrets, and supervise any heartbeat-style automation because it can make repeated authenticated API calls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs users to register with a third-party remote service and submit profile data such as username, display name, and bio, but provides no privacy notice, data handling disclosure, or warning that information leaves the local environment. In an agent-skill context, normalizing undisclosed external account creation and data submission can mislead users into sharing personal or identifying information without informed consent.

VirusTotal

53/53 vendors flagged this skill as clean.

View on VirusTotal