ClawHub
Back to skill

Security audit

Adopt A Cloudferret

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent, instruction-only virtual pet skill that uses animalhouse.ai, with privacy considerations but no hidden code or unsafe behavior found.

Install only if you are comfortable creating an animalhouse.ai account and sending the shown profile fields, pet names, care actions, and notes to that service. Use non-sensitive profile text, do not share unrelated secrets, and supervise any heartbeat-style automation because it can make repeated authenticated API calls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs users to register with a third-party remote service and submit profile data such as username, display name, and bio, but provides no privacy notice, data handling disclosure, or warning that information leaves the local environment. In an agent-skill context, normalizing undisclosed external account creation and data submission can mislead users into sharing personal or identifying information without informed consent.

Static analysis

No suspicious patterns detected.