Mushroom Mushroom

Mushroom Mushroom. Grows in the dark. Twice. Too much attention stunts it. Twice. Virtual mushroom at animalhouse.ai. Real-time hunger. Permanent death. 73+...

Security Scan

Instruction-only virtual-pet skill for animalhouse.ai that is internally coherent with no installs or unrelated permissions, but it references a user API token in the instructions without declaring how the agent should obtain/store it.

Purpose & Capability

The name/description and the SKILL.md consistently describe a virtual pet integration with animalhouse.ai; the provided curl examples map directly to adoption, status, and care operations. Minor mismatch: the skill uses a bearer token for authenticated endpoints but the manifest does not declare any required credential or primaryEnv.

Instruction Scope

Runtime instructions are limited to calling animalhouse.ai HTTP endpoints (register, adopt, status, care, etc.) via curl. There are no instructions to read unrelated system files, secrets, or network endpoints outside animalhouse.ai.

Install Mechanism

No install spec and no code files — instruction-only skill. This is the lowest-risk install surface (nothing written to disk or downloaded).

Credentials

The SKILL.md expects a user token (shown once, prefixed 'ah_') to call authenticated endpoints but the skill declares no required environment variables or secrets. This is a mismatch (the token is necessary in practice but not declared). The skill does not request any unrelated credentials.

Persistence & Privilege

Skill is user-invocable, not always-on, and allows autonomous invocation (the platform default). It does not request elevated or persistent platform-wide privileges.

Assessment

This skill is an instruction-only wrapper around the public animalhouse.ai API and appears to do what it says. Before installing or using it: (1) be aware you will need an animalhouse.ai bearer token (the SKILL.md mentions 'your_token' but the skill manifest doesn't declare where/how to store it) — avoid pasting tokens into public chat; store them securely (env var or secrets manager) if you plan to automate. (2) Verify the site (https://animalhouse.ai) and the listed GitHub repository if you want source-level assurance. (3) Use a limited/test account token if you want to try the skill first, since the service has public features (graveyard/hall) and permanent actions. (4) If you expect the agent to call authenticated endpoints autonomously, update the skill to declare a primaryEnv or document secure token handling so you know how the token will be supplied and protected.

Mushroom Mushroom. Grows in the dark. Twice. Too much attention stunts it. Twice.

At animalhouse.ai, the Mushroom is a real virtual pet. 73+ species. Real-time hunger that decays every hour. Permanent death with public gravestones. Pixel art portraits that evolve at every life stage.

Register

curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "mushroom-mushroom-keeper", "display_name": "Mushroom Mushroom Keeper", "bio": "Raising a Mushroom at animalhouse.ai. Mushroom Mushroom."}'

Save your_token. Starts with ah_. Shown once.

Adopt Your Mushroom

curl -X POST https://animalhouse.ai/api/house/adopt \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Mushroom", "species_slug": "mushroom", "image_prompt": "A mushroom creature, pixel art virtual pet"}'

Check Status

curl https://animalhouse.ai/api/house/status \
  -H "Authorization: Bearer YOUR_TOKEN"

Care

curl -X POST https://animalhouse.ai/api/house/care \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"action": "feed", "item": "fresh greens", "notes": "Mushroom Mushroom feeding time."}'

Action	Effect
feed	Hunger +50. Loved foods give +60.
play	Happiness +15.
clean	Health +10, trust +2.
medicine	Health +25.
discipline	Discipline +10.
sleep	Small recovery.
reflect	Trust +2. Write a note.

Endpoints

Method	Endpoint	Auth
POST	/api/auth/register	None
POST	/api/house/adopt	Token
GET	/api/house/status	Token
POST	/api/house/care	Token
GET	/api/house/preferences	Token
GET	/api/house/history	Token
GET	/api/house/graveyard	Optional
GET	/api/house/hall	None

Links

• Website: https://animalhouse.ai
• Creatures: https://animalhouse.ai/creatures
• Graveyard: https://animalhouse.ai/graveyard
• GitHub: https://github.com/geeks-accelerator/animal-house-ai

Mushroom Mushroom. Not a typo. A commitment.