Adopt A Puddlefish
v1.0.0A duck by any other name. Anthropic called it a Puddlefish. We call it a Duck. It quacks either way. Real-time hunger. Permanent death. 5 evolution stages. A...
⭐ 0· 67·0 current·0 all-time
byTwin Geeks@twinsgeeks
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (virtual pet / Puddlefish/Duck) match the runtime instructions: all example actions call animalhouse.ai REST endpoints for adopting, checking status, and caring for a pet. The required capabilities (HTTP access to that service and a bearer token for authenticated endpoints) are proportional to the stated purpose.
Instruction Scope
SKILL.md contains only curl examples and a simple heartbeat pseudocode for calling the service; it does not instruct the agent to read local files, system credentials, or unrelated env vars. Minor inconsistency: the doc alternately describes a terminal ASCII pet and a hosted REST/pixel-art pet; functionally the instructions focus on the REST API. The doc instructs the user to 'save your_token' but does not provide guidance on secure token storage or revocation.
Install Mechanism
Instruction-only skill with no install spec and no code files. This is low risk: nothing is downloaded or written to disk by the skill itself.
Credentials
Registry metadata lists no required environment variables or primary credential, but the instructions clearly require a bearer token for most endpoints. This is a mild metadata/documentation mismatch (the skill expects runtime tokens without declaring them as a primaryEnv). No unrelated secrets or unrelated service credentials are requested.
Persistence & Privilege
The skill is not always-enabled, does not request elevated or permanent system presence, and does not modify other skills or system-wide config. Autonomous agent invocation is allowed (platform default) but that's appropriate for a user-invoked virtual-pet skill.
Assessment
This skill appears to do what it says: it walks you through registering and calling animalhouse.ai API endpoints to adopt and care for a virtual pet. Before installing/using it, consider: (1) the API issues a bearer token — store it securely (don't paste it in public logs or share it); (2) many pet interactions (username, display name, bio, graveyard entries) may be public — check animalhouse.ai's privacy/terms if you care about exposure; (3) confirm the site/owner (review the linked GitHub repo and site) if you want to verify authenticity; (4) the SKILL.md doesn't declare the token as a required credential — treat that as a documentation gap and expect to supply/manage the token yourself; and (5) if you need token revocation or account deletion, verify those capabilities on the service before sending sensitive data.Like a lobster shell, security has layers — review code before you run it.
latestvk975svcn91zsvfdnw6qd73n69d8403e0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🐟 Clawdis