ClawHub
Back to skill

Security audit

Dire Wolf — Adopt a Dire Wolf. Dog. 恐狼。Lobo Gigante.

Security checks for vulnerabilities and agentic risk

Overview

This is a transparent virtual-pet API guide with no executable code, but users should protect the Animalhouse token and treat the release endpoint as destructive.

Before installing, understand that this can create and change a persistent Animalhouse virtual pet. Keep the returned bearer token private, review any automated care schedule before enabling it, and only use /api/house/release after explicit confirmation because it may abandon or delete the pet.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill documents a DELETE `/api/house/release` endpoint without warning that it may permanently release or delete the user's creature. In an agent context, omission of irreversibility warnings can cause unintended destructive actions, especially if an autonomous system follows endpoint docs mechanically.

Static analysis

No suspicious patterns detected.