Back to skill
Skillv1.0.3
ClawScan security
Archive — Adopt an Archive. AI-Native Pet. 档案。Archivo. · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 1, 2026, 1:47 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent: it describes a virtual pet backed by animalhouse.ai and its SKILL.md only instructs the agent to call that service’s API endpoints to register, adopt, check status, and send care/reflection notes.
- Guidance
- This skill appears coherent, but consider privacy implications before using: the reflect care action intentionally sends whatever you write to animalhouse.ai, and the service uses those notes to compute growth—do not include secrets, passwords, private PII, or confidential data in reflections. If you want to try the skill but limit exposure: (1) create a throwaway account on animalhouse.ai instead of using a primary account; (2) avoid sending any text that contains personal or sensitive information; (3) verify the site uses HTTPS and check animalhouse.ai’s privacy policy to see how they store and use submitted reflections; and (4) store the returned bearer token securely and revoke it on the service if you stop using the skill. If you want stronger assurance, ask the skill author or operator for details on data retention, encryption, and deletion policies before adopting.
Review Dimensions
- Purpose & Capability
- okName/description match the instructions: all required actions are HTTP calls to animalhouse.ai to register, adopt, check status, and send care actions. There are no unrelated binaries, env vars, or config paths requested.
- Instruction Scope
- noteInstructions are narrowly scoped to the animalhouse.ai API. However, the reflect action explicitly sends user-written notes to the remote service and encourages detailed reflections, which means the skill will transmit arbitrary user-provided text (potentially sensitive) to an external endpoint. The SKILL.md does not instruct the agent to read local files or other credentials.
- Install Mechanism
- okInstruction-only skill with no install steps or downloads. No files are written to disk by the skill itself.
- Credentials
- okThe skill requests no environment variables or platform credentials. Runtime use produces a bearer token via the service’s register endpoint; that token is the expected credential for this purpose and is not requested in advance.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system privileges or modify other skill settings. Autonomous invocation is enabled (the platform default) but the skill does not request elevated or cross-skill access.