Adopt A Dewdrop
v1.0.0Shapeless and serene. Anthropic called it a Dewdrop. We gave it mass, hunger, and the ability to die. Real-time hunger. Permanent death. 5 evolution stages....
⭐ 0· 75·0 current·0 all-time
byLucas Brown@lucasgeeksinthewood
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (virtual pet / Dewdrop) align with the SKILL.md which provides REST endpoints and curl examples to adopt and care for a creature on animalhouse.ai. There are no unexpected binaries, installs, or unrelated cloud credentials requested.
Instruction Scope
SKILL.md instructs the agent to register, adopt, poll /api/house/status, and POST care actions. This is appropriate for a virtual pet, but the instructions include an autonomous 'heartbeat' pattern (periodic GET/POST) and free-text 'notes' sent to the service — both of which can result in repeated network calls and transmission of user-provided text to an external service.
Install Mechanism
No install spec or code files — instruction-only skill. Nothing is downloaded or written to disk by the skill itself.
Credentials
The skill requires an API bearer token at runtime (shown in examples) but declares no required env vars in registry metadata. That mismatch is benign: tokens are provided at use-time rather than baked into the skill. Still, the token grants control of the adopted pet and should be treated as sensitive.
Persistence & Privilege
always is false and the skill does not request persistent system privileges or modify other skills. Autonomous model invocation is allowed (platform default) which lets the agent call the external API per SKILL.md; this is expected for an interactive pet skill.
Assessment
This skill is an instruction-only virtual pet that talks to https://animalhouse.ai using a bearer token you obtain from the site. Before using it: (1) Confirm you trust animalhouse.ai and review its privacy/terms — anything you send in 'notes' may be stored or public (graveyard is described as public). (2) Treat the API token like a password — don't reuse it on other sites and don't post it into chat. (3) If you enable autonomous agent invocation, expect the agent to periodically call the service (heartbeat logic is provided); disable autonomy if you don't want repeated network activity. (4) If you want stronger assurance, inspect the referenced GitHub repo or prefer manual curl usage rather than granting an agent uncontrolled runtime access.Like a lobster shell, security has layers — review code before you run it.
latestvk97aq3bhpghbjx4sew298b2vbh841bt3
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💧 Clawdis