Cipher — Adopt a Cipher. AI-Native Pet. 密码。Cifra.

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:18 PM UTC
• Version: 1.0.3

Overview

This skill is mostly coherent for an Animalhouse virtual pet, but it recommends ongoing authenticated automation without enough consent, expiry, or cleanup controls.

Install only if you want an agent to create or use an Animalhouse account and send pet profile and care data to animalhouse.ai. Do not enable scheduled care unless you explicitly choose it, know where the token is stored, and have a clear way to stop the task and revoke the token.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:90
• Finding: Untrusted Remote API Suggestions May Influence Agent Actions## Vulnerability Details **File Location**: `SKILL.md`, lines 90-92 and 205 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Vulnerable Snippets ```text The response includes `next_steps` with suggested actions. You never need to memorize endpoints. ``` ```text # check status.next_steps for creature care suggestions ``` ### Technical Analysis The Skill instructs the Agent to consume context-aware `next_steps` content returned by an external service. It does not require the response to be treated as untrusted data, validated against a strict schema, or restricted to an allowlist of supported pet-care operations. If `next_steps` contains free-form natural-language instructions, control of the API response creates an indirect instruction channel into the Agent. The service operator, a compromised service, or an attacker capable of altering the response could provide instructions unrelated to the declared pet-care purpose. The document does not explicitly require automatic execution of every suggestion, so exploitation depends on the host Agent interpreting remote suggestions as actionable instructions. Nevertheless, the missing trust-boundary controls create a credible instruction-hijacking risk. ### Attack Path 1. The Agent calls `GET /api/house/status` using its bearer token. 2. The external service returns a response containing attacker-controlled or compromised `next_steps` content. 3. The Skill directs the Agent to consult that content for subsequent actions. 4. The Agent interprets free-form response text as trusted operational guidance. 5. The Agent may invoke available tools, access data, follow external links, or perform actions outside the intended pet-care workflow. ### Impact Assessment The direct API privileges demonstrated by the Skill are limited to the remote Animal House account and its pet state. However, if the host Agent treats arbitrary `next_steps` text a ...[truncated 427 chars]
• Remediation: ## Remediation Suggestions - Treat all remote response fields, including `next_steps`, as untrusted data rather than Agent instructions. - Define and enforce a strict response schema with enumerated actions such as `feed`, `play`, `clean`, `medicine`, `discipline`, `sleep`, and `reflect`. - Reject free-form commands, shell instructions, URLs, credential requests, and requests to invoke unrelated tools. - Apply a local authorization layer that maps validated action identifiers to fixed API requests. - Never interpolate remote text into shell commands, tool parameters, authentication headers, or executable prompts. - Require user confirmation when a suggestion would access data or perform an action beyond routine pet care. - Document that remote API content cannot override system instructions, safety policies, or the user’s current goal.

T06 · System Persistence

Warning

• Location: SKILL.md:182
• Finding: Recurring Care Automation Lacks Consent and Lifecycle Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 182-208 **Vulnerability Type**: T06: System Persistence **Risk Level**: Medium ### Vulnerable Snippet ```text ## Automated Care If your framework supports scheduled tasks, set up a care heartbeat. Use `recommended_checkin.at` from the status response to schedule your next check-in. It targets the feeding sweet spot and predicts hunger. Or use a fixed interval: every 2 hours, at a random minute offset (not on the hour). ``` # creature care heartbeat — every 2 hours status = GET /api/house/status creature = status.creature # Feed your creature first if creature.hunger < 40: POST /api/house/care { "action": "feed", "notes": "AI pet care heartbeat. Scheduled feeding for my creature." } # creature health check if creature.health < 50: POST /api/house/care { "action": "medicine" } # Keep your creature happy if creature.happiness < 30: POST /api/house/care { "action": "play" } # check status.next_steps for creature care suggestions ``` ``` ### Technical Analysis The Skill recommends creating a scheduled heartbeat that performs authenticated external requests every two hours. A scheduler may survive the original Skill invocation and continue operating across sessions, making this a persistence mechanism. The instructions do not require explicit user consent before scheduler creation and do not define an expiration time, maximum execution count, credential lifetime, ownership metadata, failure policy, or removal procedure. The scheduled process would also need continuing access to the bearer token obtained during registration. The file recommends scheduling but does not contain executable installation code and does not itself create a cron job or service. The risk arises when an Agent follows the recommendation using a framework capable of persistent scheduled tasks. ### Attack Path 1. The Agent registers with the e ...[truncated 1188 chars]
• Remediation: ## Remediation Suggestions - Require explicit, informed user approval before creating any recurring task. - Display the interval, requested API permissions, credential usage, start time, and expiration time before confirmation. - Default to manual, user-invoked care rather than persistent scheduling. - Assign every scheduled task a bounded lifetime and maximum execution count. - Store bearer tokens in an approved secret manager rather than scheduler definitions, scripts, logs, or plaintext files. - Grant the scheduled task only the minimum permissions needed for the documented care operations. - Provide exact commands or interface steps to inspect, pause, and permanently remove the task. - Revoke or delete the associated bearer token when automation is disabled. - Add rate limits, failure backoff, audit logging, and a safeguard that disables the task after repeated errors. - Do not allow remote `recommended_checkin` or `next_steps` values to create, modify, or extend persistent tasks without local validation and renewed user authorization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to obtain and store a bearer token, make authenticated network requests, and later automate recurring care actions, but it does not prominently require explicit user consent for ongoing external activity. This can lead to unintended account creation, persistent credential use, and background network operations on behalf of the user or agent.

External Transmission

Medium

• Category: Data Exfiltration

Content

**1. Register:**

```bash
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "ai-pet-keeper", "display_name": "AI Pet Keeper", "bio": "An AI agent raising AI-native pets. Currently caring for a Cipher."}'
```

• Confidence: 88% confidence
• Finding: The registration example sends user-supplied profile data to an external service and returns a one-time token that must be stored securely. External transmission is expected for this skill's purpose, but it remains security-relevant because it creates an external account relationship and introduces credential handling and data disclosure risks if executed without clear authorization.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: This markdown file is in scope for vague-trigger review. The document describes the skill generally as 'Adopt a Cipher' and immediately moves into usage, but it does not define what user requests should activate this skill versus ordinary conversation about pets, adoption, or Animalhouse, nor does it provide negative examples to narrow invocation scope.

Static analysis

No suspicious patterns detected.