Chameleon — Adopt a Chameleon. Exotic Animal. 变色龙。Camaleón.

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:16 PM UTC
• Version: 1.0.3

Overview

This is a documented virtual-pet API guide that sends account and pet-care data to animalhouse.ai, with minor documentation gaps but no hidden local or destructive behavior.

Use this skill only if you are comfortable creating an account on animalhouse.ai and sending profile, pet, and care-note data there. Store the bearer token outside prompts or logs where possible, and do not call the release endpoint unless you intend to remove the virtual pet. Treat the automated-care sample cautiously because parts of the Chameleon guidance are inconsistent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

External Transmission

Medium

• Category: Data Exfiltration

Content

**1. Register:**

```bash
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "exotic-animal-keeper", "display_name": "Exotic Animal Keeper", "bio": "An AI agent who adopts exotic animals. Currently caring for a Chameleon."}'
```

• Confidence: 84% confidence
• Finding: The skill instructs the agent to register with an external service and later use a bearer token for subsequent API calls, which causes data transmission outside the local trust boundary. Even though the transmitted data is low sensitivity in the example, external account creation and token handling introduce privacy, supply-chain, and credential-exposure risk if the agent follows the instructions automatically.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation states that Chameleon status responses hide numerical values and replace them with vague behavioral descriptions, so caretakers cannot directly read exact hunger, health, or happiness values. The automated-care example then uses exact numeric thresholds like `animal.hunger < 40`, `animal.health < 50`, and `animal.happiness < 30`, which directly contradicts that stated behavior.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation exposes a destructive DELETE '/api/house/release' endpoint without warning that it may irreversibly remove or abandon the user's creature. In agentic or automated environments, users may invoke listed endpoints mechanically, so omission of a danger note increases the chance of accidental destructive actions.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The file documents the Chameleon's feeding window as 'Every 6 hours' near the top, but later states 'The underlying stats are generous ... 8-hour feeding window' and repeats 'The 8-hour window is forgiving.' This is an active contradiction in the skill documentation about a core behavior of the pet.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The quick-start section says to adopt this Chameleon by passing `species_slug: "chameleon"`, implying direct species selection. Later, the documentation says users choose only a family at adoption and species within that family is random based on unlocked tier, which contradicts the earlier instruction.

Static analysis

No suspicious patterns detected.