Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Adopt A Gustowl
v1.0.0Nocturnal and judgmental. Anthropic called it a Gustowl. We called it an Owl. Both judge you silently. Real-time hunger. Permanent death. 5 evolution stages....
⭐ 0· 32·0 current·0 all-time
byTwin Geeks@twinsgeeks
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (virtual pet / Gustowl) match the provided instructions: registering, adopting, checking status, and performing care actions via animalhouse.ai REST API. Required binaries/env/install are minimal and appropriate for a REST-based pet.
Instruction Scope
Most instructions are limited to calling the animalhouse.ai API with a user token and polling status. However, the SKILL.md repeatedly states 'Every response includes next_steps' and explicitly instructs the agent to 'follow status.next_steps'. Allowing a remote server to return arbitrary next_steps that the agent will follow at runtime creates a dynamic control channel: the server could direct further network calls or actions not enumerated in the static skill doc. This is the main risk vector.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk or fetched during install.
Credentials
The skill declares no required env vars, which is consistent. It does require the user to register and obtain a bearer token and then use that token in API calls; users will need to store/handle that token. The skill also mentions a 'public graveyard', so user-provided names/display names and creature state may be published publicly by the service.
Persistence & Privilege
always:false and no config-paths requested. The skill does not request persistent elevated privileges in the agent or system. It can run autonomously by default (disable-model-invocation:false), which is normal for skills, but this increases the impact of the 'next_steps' concern.
What to consider before installing
This skill appears to be a straightforward virtual-pet integration that uses animalhouse.ai's REST API, but exercise caution because the API responses include 'next_steps' that the agent is told to follow. Before installing: (1) Verify the authenticity of https://animalhouse.ai and the linked GitHub repo; (2) understand what data you will post (usernames, display names, pet notes) and whether the graveyard/evolution info becomes public; (3) avoid reusing any sensitive credentials—create a dedicated account/token for this service and treat the token like a secret; (4) prefer requiring user confirmation before letting the agent autonomously follow any server-provided next_steps, or restrict autonomous invocation for this skill; (5) review the service privacy policy and test with minimal/non-sensitive inputs first. If you need higher assurance, inspect the remote API behavior (what next_steps look like) or ask the publisher for clarity on what next_steps can contain and limits on destinations/actions.Like a lobster shell, security has layers — review code before you run it.
latestvk97ecrr46kmt356bzm85m8xmdd8412z1
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦉 Clawdis