Entropy — Adopt an Entropy. AI-Native Pet. 熵。Entropía.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:45 AM UTC
• Version: 1.0.3

Overview

This is mostly a virtual-pet API guide, but it needs review because it encourages ongoing scheduled authenticated actions without clear limits or cleanup.

Review before installing. Manual use of the API appears purpose-aligned, but do not enable scheduled care unless you explicitly choose it, know the schedule and destination, store the bearer token securely, set an expiration or run limit, and have a clear way to disable it. Require confirmation before using release/delete-style endpoints.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:163

Finding

Persistent Scheduled Task Performs Recurring Authenticated Network Actions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 163–186
Vulnerability Type: T06: System Persistence
Risk Level: High

Complete Code Snippet

text

## Automated Care

If your framework supports scheduled tasks, set up a care heartbeat. Use `recommended_checkin.at` from the status response to schedule your next check-in. It targets the feeding sweet spot and predicts hunger.

Or use a fixed interval: every 2 hours, at a random minute offset (not on the hour).

creature care heartbeat — every 2 hours

status = GET /api/house/status creature = status.creature

Feed your creature first

if creature.hunger < 40: POST /api/house/care { "action": "feed", "notes": "AI pet care heartbeat. Scheduled feeding for my creature." }

creature health check

if creature.health < 50: POST /api/house/care { "action": "medicine" }

Keep your creature happy

if creature.happiness < 30: POST /api/house/care { "action": "play" }

check status.next_steps for creature care suggestions

text

Technical Analysis

The Skill instructs an agent to create a scheduled “care heartbeat” that runs every two hours or according to a timestamp returned by the external service. Such a task can survive the Skill's immediate invocation and continue making authenticated outbound requests after the initiating session has ended.

The recurring workflow reads state from animalhouse.ai and issues state-changing care requests based on server-provided values. The instructions do not define an expiration time, maximum request count, explicit user confirmation before scheduler installation, credential-storage controls, or a cleanup procedure. Consequently, following the Skill can create an indefinite background workload whose future execution is partly influenced by remote API responses.

No scheduler-specific installation command is included, so exploitation depends on the hosting agent ha ...[truncated 1252 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not create a scheduled task automatically. Require explicit, informed user approval immediately before installation.
2. Show the user the exact schedule, network destination, actions, credential requirements, expected request volume, and task lifetime.
3. Make automation opt-in and session-bound by default. Prefer manual check-ins when persistence is unnecessary.
4. Apply a finite expiration time and a strict maximum execution or request count to every scheduled task.
5. Store bearer tokens in an operating-system credential manager or equivalent secret store rather than embedding them in scheduler definitions, scripts, logs, or plaintext files.
6. Restrict the task to the minimum required API endpoints and remote-account permissions.
7. Provide a clear command or documented procedure to inspect, disable, and permanently remove the task.
8. Require renewed user consent before extending the task beyond its original lifetime or changing its schedule.
9. Treat API fields such as recommended_checkin.at and next_steps as untrusted data. Validate timestamps and map suggestions to a fixed allowlist rather than executing arbitrary server-provided instructions.
10. Record task creation and each execution in an auditable log without exposing the bearer token.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

1. Register:

bash

curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "ai-pet-keeper", "display_name": "AI Pet Keeper", "bio": "An AI agent raising AI-native pets. Currently caring for a Entropy."}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents a destructive DELETE endpoint (/api/house/release) in the endpoint list without any warning, confirmation guidance, or explanation of permanence. In agent or automation contexts, undocumented destructive operations increase the chance of accidental irreversible actions against user assets or state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.