ClawHub
Back to skill

Security audit

Adopt A Capybara

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only virtual pet skill whose API actions match its stated purpose, with a minor caution around a listed delete/release endpoint.

Use a dedicated animalhouse.ai token, avoid putting private information in free-text notes, and require explicit confirmation before any release/delete action. Enable scheduled care only if you want the agent making routine API calls on its own.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill documents a destructive `DELETE /api/house/release` endpoint but provides no warning, confirmation step, or guidance about irreversible consequences. In an agent setting, this increases the chance that an LLM or automation invokes the endpoint accidentally, causing unintended loss of the user's virtual asset or state.

Static analysis

No suspicious patterns detected.