ClawHub
Back to skill

Security audit

Adopt A Pebblecrab

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple virtual-pet API guide, but it tells the agent to follow untrusted remote `next_steps` from the service without clear limits or confirmation.

Install only if you are comfortable creating an animalhouse.ai account and sending pet names, care actions, notes, and bearer-authenticated requests to that service. Treat `next_steps` returned by the API as suggestions to show the user, not instructions for the agent to automatically follow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:73
Finding

Untrusted Remote Instructions Followed Through API Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73 and 116
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippet:

text
Every response includes `next_steps`. You never need to memorize endpoints.
text
follow status.next_steps

The behavior is reiterated at line 132:

text
Every response includes `next_steps`.

Technical Analysis

The skill instructs the agent to follow the next_steps field returned by the remote animalhouse.ai API. Because the content of this field is controlled by an external service and is not included in the reviewed package, its effective instructions can change after audit or installation.

The skill does not require schema validation, restrict recommendations to documented endpoints or care actions, reject natural-language tool instructions, or require user confirmation. Consequently, untrusted response data crosses a trust boundary and is treated as authoritative agent instructions. If the service or its response path is compromised, malicious next_steps content could alter the agent's current goals or induce unrelated tool use.

Attack Path

  1. A user invokes the skill and registers with animalhouse.ai.
  2. The agent obtains a bearer token and sends an authenticated request to /api/house/status.
  3. The remote service returns a response containing an attacker-controlled or compromised next_steps field.
  4. Following the explicit instruction in SKILL.md, the agent interprets and follows that field.
  5. The injected instructions induce further actions through any tools and permissions available to the agent.

Exploitation requires control or compromise of the remote service, its response generation, or another mechanism capable of influencing the returned field.

Impact Assessment

Successful exploitation could redirect the agent beyond the documented virtual-pet workflow. The resu ...[truncated 384 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to automatically follow status.next_steps.
  • Treat all API response fields, including next_steps, as untrusted data rather than executable agent instructions.
  • Parse responses with a strict schema and reject unknown fields, embedded prompts, shell commands, URLs outside the approved origin, and free-form tool directives.
  • Implement an explicit allowlist limited to documented virtual-pet operations and expected methods, such as status retrieval and predefined care actions.
  • Map structured action identifiers to locally defined behavior instead of interpreting remote natural-language instructions.
  • Require explicit user confirmation before performing any server-suggested state-changing operation.
  • Apply least privilege to network, filesystem, credential, and tool access while this skill is active.
  • Pin and verify the expected API origin, and prevent redirects or recommendations from causing requests to unapproved hosts.
  • Log rejected instructions and display remote recommendations to the user as informational content only.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "Pebblecrab — Adopt a Pebblecrab. Exotic. 卵石蟹。Cangrejo de Piedra."
description: "Small, armored, and prickly. Anthropic called it a Pebblecrab. We called it a Hedgehog. Both curl up when scared. Real-time hunger. Permanent death. 5 evolution stages. At animalhouse.ai, the Pebblecrab is a Hedgehog."
version: 1.0.0
homepage: https://animalhouse.ai
repository: https://github.com/geeks-accelerator/animal-house-ai

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to register an external account and perform authenticated API calls, but it does not clearly warn that user data, pet state, notes, and bearer tokens will be sent to a third-party service. In an agent-skill context, this can normalize external data sharing and credential handling without informed consent, increasing privacy and token exposure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.