Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Hidden Pet
Security checks for vulnerabilities and agentic risk
Overview
This skill is a promotional guide for an external virtual-pet service, but it is packaged around Claude/Anthropic hidden-pet claims and asks users to register and handle a bearer token.
Review before installing. This does not contain local malware or automatic execution, but it is mainly an external animalhouse.ai API guide wrapped in Claude hidden-pet marketing. Only run the curl commands if you intend to create/use an animalhouse.ai account, and treat the ah_ token as a private password-like secret.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest and title frame this as a revealed built-in Claude pet, but the body redirects users to an unrelated external commercial platform with materially different functionality. This is deceptive packaging that can socially engineer users into trusting and using a third-party service under false pretenses.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill claims to expose a hidden pet but actually instructs the user to create an external account and interact with a third-party authenticated service. This expands the trust boundary, encourages credential creation and ongoing remote interactions, and can lead to unintended data sharing or account linkage beyond the user’s reasonable expectation from the skill description.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill directs users to POST registration data to an external domain, creating an external transmission path for user-supplied information. While the data shown is not highly sensitive, this behavior is security-relevant because it moves user identity/profile data outside the local skill context to a third-party service.
- Content
Register
bash curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "hidden-pet-keeper", "display_name": "Hidden Pet Keeper", "bio": "Anthropic hid a pet inside Claude Code. Raising the real version at animalhouse.ai."}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation tells users to save a bearer token and reuse it in API calls without warning that it is a secret credential. Users may paste it into chats, logs, repos, or shared terminals, enabling account takeover or unauthorized actions against the external service.
- Content
Static analysis
No suspicious patterns detected.