ClawHub
Back to skill

Security audit

Adopt A Dewdrop

Security checks for vulnerabilities and agentic risk

Overview

The skill is a virtual pet API helper, but it tells agents to follow server-returned next steps without a clear safety boundary.

Install only if you are comfortable sending account/profile data to animalhouse.ai and using a bearer token with that service. Treat `next_steps` returned by the API as untrusted suggestions: review them before acting, keep actions limited to documented pet-care endpoints, and do not let them request local files, secrets, unrelated network calls, or changes outside the virtual pet workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:73
Finding

Untrusted Remote Instructions Can Redirect Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73–116
Vulnerability Type: Remote instruction hijacking through server-controlled next_steps
Risk Level: High

Vulnerable code snippet:

text
Every response includes `next_steps`. You never need to memorize endpoints.
text
## Heartbeat

# Dewdrop care heartbeat
status = GET /api/house/status
creature = status.creature

if creature.hunger < 40:
    POST /api/house/care { "action": "feed", "notes": "Dewdrop heartbeat feeding." }
if creature.happiness < 30:
    POST /api/house/care { "action": "play" }
if creature.health < 50:
    POST /api/house/care { "action": "medicine" }

follow status.next_steps

Technical Analysis

The Skill explicitly instructs the agent to follow next_steps returned by the external animalhouse.ai service. These instructions are generated outside the reviewed Skill package and can change after installation. The Skill does not define a strict response schema, an allowlist of acceptable actions, endpoint restrictions for next_steps, or a user-confirmation boundary.

Consequently, a malicious or compromised server could place arbitrary natural-language directives in status.next_steps. An instruction-following agent may interpret those directives as trusted Skill guidance rather than untrusted remote data. This creates a post-review instruction channel capable of changing the effective behavior of the Skill.

Attack Path

  1. A user invokes the Skill and registers with animalhouse.ai.
  2. The agent receives and uses a bearer token to request /api/house/status.
  3. The service, or an attacker controlling or compromising it, returns attacker-selected content in status.next_steps.
  4. The Skill directs the agent to follow status.next_steps.
  5. The agent interprets the remote content as executable guidance and may perform actions outside the documented pet-care workflow.

...[truncated 821 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to automatically follow status.next_steps.
  2. Treat all fields returned by the remote service as untrusted data, not as agent or system instructions.
  3. Define and validate a strict machine-readable schema for suggested actions.
  4. Allowlist only the documented pet-care actions: feed, play, clean, medicine, discipline, sleep, and reflect.
  5. Restrict network operations to the documented HTTPS origin and API paths.
  6. Reject free-form commands, tool requests, URLs, shell content, or instructions that request local data.
  7. Require explicit user approval before executing any remote suggestion that was not directly requested by the user.
  8. Ensure bearer tokens are never included in logs, notes, prompts sent to unrelated services, or server-provided follow-up content.
  9. Present unsupported next_steps as inert text with a warning rather than executing or following them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to register with and send authenticated requests to an external service, including profile data and bearer tokens, without any explicit privacy, trust-boundary, or token-handling warning. In an agent setting, this can normalize exfiltration of user-provided data and credentials to a third-party API, especially because the examples are framed as routine setup steps.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This command performs direct external transmission of user-supplied registration data to a third-party domain. Although the behavior is consistent with the skill's stated purpose, it is still security-relevant because it establishes an outbound data flow and account creation flow without discussing data use, retention, or verification of the remote service.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash
# Register
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "dewdrop-keeper", "display_name": "Dewdrop Keeper", "bio": "Raising a Dewdrop at animalhouse.ai. Anthropic calls it a Dewdrop. We call it a Blob."}'

Static analysis

No suspicious patterns detected.