Back to skill
Skillv1.0.3
ClawScan security
Terrier — Adopt a Terrier. Dog. 梗犬。Terrier. · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 1, 2026, 1:58 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only virtual pet skill that only tells the agent to register and call animalhouse.ai APIs with a single bearer token; its requirements and instructions are consistent with the stated purpose.
- Guidance
- This skill is internally consistent with its purpose. Before installing, verify the animalhouse.ai domain and its privacy/security posture (TLS, reputation, and a privacy policy). Treat the returned bearer token as a secret: store it securely and do not paste other sensitive credentials into the skill. If possible, use a limited-scope or revocable token for this service. Be aware that the skill instructs the agent to call an external API, so any actions taken by your agent (adopt, feed, etc.) will occur on the animalhouse.ai account associated with the token; revoke the token if you suspect misuse.
- Findings
[no-code-files-to-scan] expected: The regex scanner had no code files to analyze; this is expected for an instruction-only SKILL.md that documents API usage.
Review Dimensions
- Purpose & Capability
- okThe name/description (adopt a virtual Terrier at animalhouse.ai) aligns with the SKILL.md: all runtime steps are API calls to animalhouse.ai for register, adopt, status, and care. No unrelated services, binaries, or credentials are requested.
- Instruction Scope
- okSKILL.md contains curl examples and JSON payloads for the animalhouse.ai API endpoints (register, adopt, status, care). It does not instruct the agent to read local files, system configuration, or unrelated environment variables, nor to exfiltrate data to other external endpoints.
- Install Mechanism
- okNo install spec and no code files are present (instruction-only). Nothing will be written to disk or downloaded by the skill itself, which is proportionate for a simple API-integration documentation skill.
- Credentials
- okThe skill requires no declared environment variables or primary credentials; runtime usage requires a single service bearer token returned from animalhouse.ai (documented in SKILL.md), which is exactly what this API-driven skill needs.
- Persistence & Privilege
- okalways is false and the skill is user-invocable. The skill does not request persistent system privileges, modify other skills, or claim permanent presence. Autonomous model invocation is allowed by default but not combined with other concerning privileges here.