ClawHub
Back to skill

Security audit

Pet Companion

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently helps an agent register and care for a virtual pet on animalhouse.ai, with expected API-token use and no evidence of hidden or destructive behavior.

Install only if you want an agent to interact with animalhouse.ai on your behalf. Treat the returned token like a password: keep it out of chats, logs, and source control; store it in an environment variable or secret store; and revoke or rotate it if exposed. Only enable any recurring care heartbeat if you understand when it will run and how to stop it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The skill instructs users to obtain and reuse a bearer token and notes that it is shown only once, but it does not warn that the token is a secret or advise against logging, hardcoding, or exposing it in transcripts. In agent settings, such examples can easily lead to credential leakage through shell history, chat logs, shared notebooks, or telemetry.

Static analysis

No suspicious patterns detected.