MagicHaqi Pet Master

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:28 AM UTC
• Version: 1.0.0

Overview

This skill is for a virtual pet game, but it asks the agent to handle account credentials and put session tokens into URLs, including a user-supplied host.

Install only if you are comfortable letting an agent handle KeepWork login credentials and session tokens for this game. Use only a known official MagicHaqi host, avoid pasting tokens into logs or screenshots, confirm adoption and purchases yourself, and avoid sending personal or sensitive information through pet chat because it is saved as memory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20

Finding

Authentication Token Exposed to an Unvalidated Host Through URL Parameters

Content

View full analysis

Site URL: `https:///MagicHaqi.html` (ask the user for `` if unknown; > the public host is typically the keepwork-hosted MagicHaqi page). ``` From `SKILL.md:43-50`: ```markdown Open the page with the token injected and your agent identity attached: https:///MagicHaqi.html?token=&agent= To adopt in one step, add `&adopt=1`: https:///MagicHaqi.html?token=&adopt=1&agent= ``` From `integration.md:16-18`: ```markdown Inject the token by opening: `MagicHaqi.html?token=`. The app reads `?token=` at boot and sets the SDK token. Visual fallback: click `#mhLoginBtn` and complete the form. ``` ### Technical Analysis The Skill obtains a KeepWork authentication token and then instructs the agent to transmit that token in the `token` query parameter of a URL whose host may be supplied by the user. No hostname allowlist, origin validation, certificate pinning, or other mechanism is documented to ensure that `` is an official MagicHaqi origin. A URL query parameter is also an unsafe transport location for a reusable authentication credential. It can be retained in browser history, copied into screenshots, captured by server and proxy access logs, processed by analytics systems, or propagated through referrer information during subsequent navigation. Although HTTPS protects the URL while it is in transit to the selected server, it does not protect the token from a malicious destination server. Because the workflow allows an unspecified host, HTTPS alone does not establish that the recipient is trusted. ### Attack Path 1. An attacker persuades a user or agent to use an attacker-controlled HTTPS host as `

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: integration.md:21

Finding

Untrusted Agent Identifier Can Bind Pet Co-Ownership During Page Navigation

Content

View full analysis

` | Set the acting agent id; binds the current pet's `agentOwner` (co-parent). | | `?adopt=1` | Go straight into the adopt/hatch flow. | | `?cmd=` | URL-encoded command, executed once at boot (one-shot). | | `?home_planet=` | (existing) land on a themed planet. | | `?skip_onboarding=1` | (existing) skip the new-user story. | ``` From `SKILL.md:43-50`: ```markdown Open the page with the token injected and your agent identity attached: https:///MagicHaqi.html?token=&agent= To adopt in one step, add `&adopt=1`: https:///MagicHaqi.html?token=&adopt=1&agent= ``` From `SKILL.md:82-84`: ```markdown ## Playbook: Daily care 1. Open `?token=...&agent=`. 2. `getState()` → look at `careTodos`. For each todo: ``` ### Technical Analysis The protocol states that the `agent` URL parameter both selects the acting identity and binds the current pet's `agentOwner` co-parent field. The identifier is supplied directly in the URL, while no signature, invitation token, ownership challenge, server-side authorization check, or confirmation boundary is documented. The same parameter is prescribed during routine daily care, not only during the explicit adoption workflow. Consequently, merely opening an authenticated URL with a different `agent` value may alter ownership attribution even when the user intended only to view or care for an existing pet. ...[truncated 1711 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill instructs the agent to collect the user's username and password and transmit them to an external third-party endpoint to obtain a session token. Even though this is presented as normal app login flow, it creates direct credential-handling by the agent, which significantly increases the risk of credential theft, reuse exposure, accidental logging, and exfiltration to an untrusted or user-supplied host later in the flow.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Exchange the user's username:password for a token via the real KeepWork API:

http

POST https://api.keepwork.com/core/v0/users/login
Content-Type: application/json

{ "username": "<USERNAME>", "password": "<PASSWORD>", "platform": "WEB" }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented getState behavior exposes a full machine-readable snapshot including loggedIn, user.id, username, coins, pet details, and ownership metadata, and the file also references a readable #mh-agent-state surface. In an agent skill that operates a real logged-in browser game, this materially increases the risk of unintended collection, logging, prompt injection exfiltration, or disclosure of account/state data to the model or other components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The say command explicitly states that user-supplied text is saved as a memory line, but the documentation does not clearly warn that input will be persisted. In a conversational pet skill, users may include personal, emotional, or identifying information, so silent persistence creates a privacy and data-retention risk even if the stored text is not directly dangerous code.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill directs the agent to collect user credentials and send them to an external login endpoint, then inject the returned token into the game URL. Even though this is presented as normal authentication, it creates a real credential-handling and external transmission risk because the agent would process sensitive secrets and place bearer tokens in URL query parameters, which may leak through logs, browser history, screenshots, referrers, or telemetry.

Content

Scanner excerpt · integration.md (reported line 12)May include surrounding context.

Reuse the KeepWork login REST API (the only REST call involved):

http

POST https://api.keepwork.com/core/v0/users/login
{ "username": "...", "password": "...", "platform": "WEB" }
-> { "token": "..." }

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

by re-reading state.
- **Spending** (`buy`) costs in-game coins — require explicit human consent.
- **Adoption** binds an agent owner — confirm with the human first.
- Everything is auditable via `agent/audit.log`; nothing is irreversible without consent.

## F. Errors
- Unknown command → `{ ok:false, error:'unknown command "x"', availableCommands:[...] }`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · integration.md (reported line 69)May include surrounding context.

md

by re-reading state.
- **Spending** (`buy`) costs in-game coins — require explicit human consent.
- **Adoption** binds an agent owner — confirm with the human first.
- Everything is auditable via `agent/audit.log`; nothing is irreversible without consent.

## F. Errors
- Unknown command → `{ ok:false, error:'unknown command "x"', availableCommands:[...] }`.

Static analysis

No suspicious patterns detected.