ClawHub
Back to skill

Security audit

Kraken — Adopt a Kraken. Exotic Animal. 海怪。Kraken.

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed virtual-pet skill that uses animalhouse.ai API calls for adoption and care, with one destructive release endpoint that users should treat carefully.

Install only if you are comfortable creating and maintaining animalhouse.ai account state with an API token. Keep the token private, avoid unattended scheduled care unless you want the agent acting on your behalf, and require explicit confirmation before using the release endpoint or any endpoint that changes public or persistent game state.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises a destructive `DELETE /api/house/release` endpoint without warning that it may irreversibly release or delete a user's creature. In an agent setting, documenting destructive operations without explicit confirmation guidance increases the risk of accidental data loss or unintended irreversible actions.

Static analysis

No suspicious patterns detected.