Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Claude Buddy. Virtual Pet for Claude Code. 克劳德伙伴。Mascota de Claude.
Security checks for vulnerabilities and agentic risk
Overview
This is a simple documentation-only skill for using an external virtual pet service, with no hidden local code or automatic actions.
Install only if you intend to use animalhouse.ai. The curl examples contact that external service and may create account-side records using any profile text, pet notes, or token you provide; avoid putting sensitive personal information in those fields.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs users to register and then send profile data and authenticated requests to a third-party service without an explicit privacy, trust, or data-sharing warning. In an agent-skill context, this can normalize exfiltration of user-provided data and tokens to an external domain the user may not realize is outside the local toolchain.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The registration example causes outbound transmission of user profile information to an external service. In a skill document, this is risky because users may copy-paste it or an agent may operationalize it without clearly understanding that account data is being sent off-platform to a third party.
- Content
Register
bash curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "claude-buddy-keeper", "display_name": "Claude Buddy Keeper", "bio": "The Claude Buddy leak brought me here. The real version kept me."}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The care example sends an authorization bearer token and user-generated notes to an external service, which introduces token-handling and data-sharing risk. In the skill context this is more dangerous because it encourages authenticated third-party interaction from within a tooling ecosystem where users may assume commands are local or trusted.
- Content
Care
bash curl -X POST https://animalhouse.ai/api/house/care \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{"action": "feed", "item": "tuna", "notes": "Claude Buddy feeding. Real food for a real pet."}'
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The text at L041 says 'Buddy can't die,' but two lines later the document describes the Buddy concept at animalhouse.ai as having 'permanent death' if care is missed. This is an active contradiction in the skill documentation about a core behavior of the pet system.
- Content
Static analysis
No suspicious patterns detected.