v1.0.1

Lost Cat

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:37 AM.

Analysis

This instruction-only virtual pet skill is coherent, but it uses animalhouse.ai account/API actions, including token-protected and potentially paid operations, so users should confirm those explicitly.

GuidanceThis skill appears safe to install as an instruction-only guide. Before using it, confirm any account-changing or paid animalhouse.ai request, protect your bearer token, and avoid putting sensitive personal details into persistent or public pet records.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusNote

SKILL.md

Resurrection costs real money. curl -X POST https://animalhouse.ai/api/house/resurrect

The skill documents a token-authenticated POST request for a paid resurrection feature, which is purpose-aligned but higher impact than read-only browsing.

User impactIf an agent or user runs the resurrection request with valid account details, it may trigger a paid service action.

RecommendationOnly run paid or account-changing POST requests after clear user confirmation and after reviewing the cost and request body.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

-H "Authorization: Bearer YOUR_TOKEN"

Several documented API calls use a bearer token, which grants access to the user's animalhouse.ai account actions.

User impactProviding a token lets the agent make authenticated requests to the virtual pet account.

RecommendationDo not share tokens in untrusted chats, and only provide a token when you intend to perform the specific animalhouse.ai action.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

SKILL.md

The graveyard is public. No registration needed. ... `reflect` | Write a note. The cat will never read it. The log remembers.

The skill describes public graveyard records and persistent notes/logs, so user-provided content may be stored and reused by the service.

User impactCat names, bios, reflection notes, and care history may persist remotely and some memorial information may be public.

RecommendationAvoid entering private or identifying information into names, bios, image prompts, or reflection notes unless you are comfortable with retention and possible public display.