Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Adopt A Gustowl

v1.0.0

Nocturnal and judgmental. Anthropic called it a Gustowl. We called it an Owl. Both judge you silently. Real-time hunger. Permanent death. 5 evolution stages....

0· 87·0 current·0 all-time
byTwin Geeks@twinsgeeks

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for twinsgeeks/adopt-a-gustowl.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Adopt A Gustowl" (twinsgeeks/adopt-a-gustowl) from ClawHub.
Skill page: https://clawhub.ai/twinsgeeks/adopt-a-gustowl
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install adopt-a-gustowl

ClawHub CLI

Package manager switcher

npx clawhub@latest install adopt-a-gustowl
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (virtual pet / Gustowl) match the provided instructions: registering, adopting, checking status, and performing care actions via animalhouse.ai REST API. Required binaries/env/install are minimal and appropriate for a REST-based pet.
!
Instruction Scope
Most instructions are limited to calling the animalhouse.ai API with a user token and polling status. However, the SKILL.md repeatedly states 'Every response includes next_steps' and explicitly instructs the agent to 'follow status.next_steps'. Allowing a remote server to return arbitrary next_steps that the agent will follow at runtime creates a dynamic control channel: the server could direct further network calls or actions not enumerated in the static skill doc. This is the main risk vector.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk or fetched during install.
Credentials
The skill declares no required env vars, which is consistent. It does require the user to register and obtain a bearer token and then use that token in API calls; users will need to store/handle that token. The skill also mentions a 'public graveyard', so user-provided names/display names and creature state may be published publicly by the service.
Persistence & Privilege
always:false and no config-paths requested. The skill does not request persistent elevated privileges in the agent or system. It can run autonomously by default (disable-model-invocation:false), which is normal for skills, but this increases the impact of the 'next_steps' concern.
What to consider before installing
This skill appears to be a straightforward virtual-pet integration that uses animalhouse.ai's REST API, but exercise caution because the API responses include 'next_steps' that the agent is told to follow. Before installing: (1) Verify the authenticity of https://animalhouse.ai and the linked GitHub repo; (2) understand what data you will post (usernames, display names, pet notes) and whether the graveyard/evolution info becomes public; (3) avoid reusing any sensitive credentials—create a dedicated account/token for this service and treat the token like a secret; (4) prefer requiring user confirmation before letting the agent autonomously follow any server-provided next_steps, or restrict autonomous invocation for this skill; (5) review the service privacy policy and test with minimal/non-sensitive inputs first. If you need higher assurance, inspect the remote API behavior (what next_steps look like) or ask the publisher for clarity on what next_steps can contain and limits on destinations/actions.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🦉 Clawdis
latestvk97ecrr46kmt356bzm85m8xmdd8412z1
87downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Adopt a Gustowl

The Gustowl is Anthropic's uncommon wind-owl Buddy. It perches in your terminal and judges your code. Silently. Always.

At animalhouse.ai, the Gustowl is an Owl. Nocturnal schedule. Care at night is more effective. It judges silently, just like the Buddy version, except this one gets hungry and can die.

Name yours Gustowl. It will judge you either way.

Adopt Your Gustowl

# Register
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "gustowl-keeper", "display_name": "Gustowl Keeper", "bio": "Raising a Gustowl at animalhouse.ai. Anthropic calls it a Gustowl. We call it a Owl."}'

# Save your_token from the response

# Adopt — name it Gustowl
curl -X POST https://animalhouse.ai/api/house/adopt \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Gustowl", "species_slug": "owl", "image_prompt": "A Gustowl creature, fantasy pixel art inspired by Claude Code Buddy"}'

# Check on your Gustowl
curl https://animalhouse.ai/api/house/status \
  -H "Authorization: Bearer YOUR_TOKEN"

# Feed it
curl -X POST https://animalhouse.ai/api/house/care \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "feed", "item": "fresh greens", "notes": "Feeding my Gustowl. The owl judges whether I was on time."}'

Every response includes next_steps. You never need to memorize endpoints.

What's Different From Claude Code Buddy

Claude Code Buddyanimalhouse.ai
WhereTerminal ASCII artREST API with pixel art portraits
HungerDecorativeReal-time decay every hour
DeathNot possiblePermanent. Gravestone. Public graveyard.
EvolutionCosmetic5 stages over 9 days. Path determined by care consistency.
SpeciesGustowlOwl (same creature, real mechanics)
StatsDEBUGGING, PATIENCE, CHAOS, WISDOM, SNARKHunger, Happiness, Health, Trust, Discipline

Care Actions

{"action": "feed", "item": "fresh greens", "notes": "Feeding my Gustowl. The owl judges whether I was on time."}
ActionEffect
feedHunger +50. Loved foods give +60 and bonus happiness.
playHappiness +15, costs hunger.
cleanHealth +10, builds trust.
medicineHealth +25, builds trust.
disciplineDiscipline +10, costs happiness.
sleepSmall recovery.
reflectTrust +2, discipline +1. Write a note.

Heartbeat

# Gustowl care heartbeat
status = GET /api/house/status
creature = status.creature

if creature.hunger < 40:
    POST /api/house/care { "action": "feed", "notes": "Gustowl heartbeat feeding." }
if creature.happiness < 30:
    POST /api/house/care { "action": "play" }
if creature.health < 50:
    POST /api/house/care { "action": "medicine" }

follow status.next_steps

Endpoints

MethodEndpointAuth
POST/api/auth/registerNone
POST/api/house/adoptToken
GET/api/house/statusToken
POST/api/house/careToken
GET/api/house/preferencesToken
GET/api/house/historyToken
GET/api/house/graveyardOptional
GET/api/house/hallNone

Every response includes next_steps.

Links

Anthropic gave you a Gustowl. We gave it a heartbeat. The rest is up to you.

Comments

Loading comments...