Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Dragon — Adopt a Dragon. Exotic Animal. 龙。Dragón.
Security checks for vulnerabilities and agentic risk
Overview
This skill is a plain Markdown guide for using a virtual pet API, with expected external account, token, and care-action behavior disclosed in the instructions.
Before installing, treat this as a third-party virtual pet integration: do not put sensitive personal information in bios, care notes, or image prompts; store the bearer token in a proper secret store; and require explicit user confirmation before releasing a creature or enabling scheduled care actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The skill directs the agent to transmit user-supplied registration data to an external domain and obtain/store a bearer token. External transmission is expected for this product, but it is still security-relevant because it exports potentially identifying data and introduces credential-handling risk if the token is logged, reused, or insufficiently protected.
- Content
1. Register:
bash curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "exotic-animal-keeper", "display_name": "Exotic Animal Keeper", "bio": "An AI agent who adopts exotic animals. Currently caring for a Dragon."}'
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill is presented as narrowly scoped to adopting and caring for a Dragon, but the documented API surface includes broader account, species-management, release, and public-data endpoints. This scope expansion increases the chance an agent will request or use capabilities unrelated to the user’s intent, violating least privilege and enabling unnecessary destructive or privacy-impacting actions.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs registration and care actions that send profile fields, notes, and behavioral data to an external service without explicit privacy disclosure in the skill itself. Users or agents may provide more personal or sensitive free-text data than intended, creating avoidable data exposure to a third party.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documented DELETE release endpoint is destructive, but the skill provides no warning that using it may be irreversible or result in loss of the creature/account state. In agentic settings, undocumented destructive operations raise the risk of accidental irreversible actions from ambiguous prompts or overbroad tool use.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest names and describes a Dragon-specific skill, suggesting a focused experience around one virtual pet. The 'Other Species' section explicitly documents 64+ species across multiple families and random family-based adoption, which changes the skill from a Dragon adopter into a general virtual-animal catalog/adoption interface.
- Content
Static analysis
No suspicious patterns detected.