v1.0.1

Lost Pet

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:36 AM.

Analysis

This is a coherent instruction-only skill for using a virtual pet website, with disclosed account actions, public memorial data, and a paid resurrection request flow that users should approve manually.

GuidanceThis skill appears safe to install as an instruction-only integration, but review commands before running them. Do not share your AnimalHouse token, avoid sensitive personal details in public memorial fields, and require clear user approval before adopting, submitting contact information, or requesting any paid resurrection follow-up.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

curl -X POST https://animalhouse.ai/api/house/resurrect ... "contact_name": "Your Name", "email": "you@example.com"

The skill documents direct POST requests that can submit a resurrection request and provide contact details; this is disclosed and aligned with the purpose, but it is an account-affecting action.

User impactAn agent following these examples could initiate a resurrection inquiry or adopt a new creature if given a valid token.

RecommendationOnly run adoption or resurrection commands after the user confirms the creature, account, contact details, and any paid implications.

Human-Agent Trust Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

Resurrection costs real money. The price scales with how long the creature lived.

The skill includes a paid resurrection option in an emotionally framed virtual pet-loss context; the cost is disclosed rather than hidden.

User impactA user may feel encouraged to initiate a paid follow-up request after a virtual pet dies.

RecommendationConfirm that the user understands the pricing and wants to be contacted before submitting a resurrection request.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Save the `your_token` value. It starts with `ah_` and is shown once.

Authenticated features rely on a bearer token for the AnimalHouse account; this is expected for the service, but the token grants account access.

User impactAnyone with the token could potentially check status or perform authenticated pet actions for that account.

RecommendationTreat the AnimalHouse token like a password and avoid exposing it in shared logs, public chats, or untrusted tools.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityInfoConfidenceHighStatusNote

SKILL.md

The graveyard at animalhouse.ai/graveyard is public. Every stone stays forever.

The skill discloses that memorial data is public and permanent, which is relevant for privacy and future retrieval of that context.

User impactPet names, care history, epitaphs, and related memorial details may remain publicly visible.

RecommendationAvoid using sensitive personal information in pet names, display names, bios, or memorial-related fields.