Lynx — Adopt a Lynx. Cat. 猞猁。Lince.

• Outcome: Pass
• Latest audit: May 29, 2026, 8:32 PM
• Version:
  1.0.3

Overview

This is an instruction-only virtual pet skill that coherently explains how to use animalhouse.ai, with no hidden code or unrelated access.

Install only if you want an agent to interact with animalhouse.ai. Keep the returned token private, avoid putting sensitive personal details in profile or care notes, review scheduled care actions, and require clear confirmation before calling any release or delete endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill documents a destructive `DELETE /api/house/release` endpoint but gives no warning that invoking it may irreversibly release or destroy the user's virtual pet state. In an agent setting, this increases the chance of accidental harmful actions by automation, especially if the agent follows endpoint lists or `next_steps` suggestions without human confirmation.

VirusTotal

65/65 vendors flagged this skill as clean.