Security audit

OpenPet

Security checks for vulnerabilities and agentic risk

Overview

This virtual pet skill is not obviously malicious, but it should be reviewed because it creates a recurring background task and proactive chat alerts without clear user controls.

Install only if you are comfortable with the skill keeping per-user pet files that include platform identifiers and with a background task that may continue running and send chat alerts. Prefer a pinned release, and look for controls to pause or remove the cron job, delete pet data, and opt out of proactive messages.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

Location: SKILL.md:78
Finding: Persistent Recurring Task Is Created Without Explicit User Consent
Content: View full analysis
80 or happiness <20) - Increment age daily ``` ### Technical Analysis The skill instructs the agent to create a recurring cron job named `openpet-tick`. A scheduled task survives the interaction in which the skill is invoked and continues executing every two hours. This constitutes system persistence because it causes ongoing activity across sessions. The task is intended to implement the virtual pet's decay mechanic, but the instructions do not require explicit user authorization before establishing persistence. They also do not specify a lifecycle policy, execution scope, secure scheduler interface, ownership validation, or an uninstall procedure. The scheduled task modifies persistent pet records and can generate outbound alerts. If the task is created through a system-level cron facility rather than a scheduler scoped to the skill, it may inherit broader filesystem or messaging permissions than the pet functionality requires. ### Attack Path 1. A user installs or invokes the OpenPet skill. 2. The agent processes the instruction to set up `openpet-tick`. 3. A recurring task is registered to execute every two hours. 4. The task continues running after the original interaction or agent session ends. 5. Each execution reads and modifies pet state, evaluates alert conditions, and may send messages to owners. 6. Without documented removal or lifecycle handling, the task can continue until manually discovered and disabled. This path does not demonstrate a covert backdoor or arbitrary command execution. The confirmed issue is the unconsented and unmanaged persistent execution mechanism. ### Im ...[truncated 702 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:8
Finding: Installation Instructions Use an Unpinned Mutable GitHub Source
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill design explicitly stores persistent per-user records containing identifiers and personal data such as user ID, platform, and ownerName in predictable file paths, but the skill description provides no notice, consent flow, retention policy, or minimization guidance. This creates privacy risk through unnecessary collection and exposure of user-linked data, especially in multi-platform environments where local files may be readable, backed up, or mishandled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill specifies proactive alerts sent to users on their origin platform, including status-related messages and death/evolution notifications, without warning users in the skill description that the system may message them outside an immediate command response. Unsolicited or unexpected outbound messaging can violate user expectations and platform policies, and it increases privacy and abuse risk if alerts are misrouted or overly frequent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.