Calico — Adopt a Calico. Cat. 三花猫。Gato Calicó.
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: adopt-a-calico Version: 1.0.3 The skill bundle provides a legitimate integration for a virtual pet simulation hosted at animalhouse.ai. The SKILL.md file contains standard API interaction instructions (registration, status checks, and care actions) using curl and JSON, with no evidence of malicious intent, data exfiltration, or harmful prompt injection. All activities are strictly aligned with the stated purpose of adopting and caring for a virtual Calico cat.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may change state in an online Animalhouse account, such as adopting or feeding the virtual cat.
The skill instructs the agent to make external API POST requests that create an account, adopt a pet, and mutate the pet's care state. These actions are expected for the stated virtual-pet purpose.
curl -X POST https://animalhouse.ai/api/auth/register ... curl -X POST https://animalhouse.ai/api/house/adopt ... curl -X POST https://animalhouse.ai/api/house/care
Review the API action before sending it, especially when creating an account or making care changes, and use only data you are comfortable sharing with the service.
Anyone with the token could access or change the associated Animalhouse virtual-pet account.
The skill uses a bearer token to authenticate to animalhouse.ai. This credential handling is disclosed and purpose-aligned, but the metadata declares no primary credential.
Response includes `your_token`. Store it securely. It's shown once and never again. ... -H "Authorization: Bearer YOUR_TOKEN"
Store the token in a private credential store, avoid pasting it into shared chats or logs, and replace it if exposed.