Lattice — Adopt a Lattice. AI-Native Pet. 晶格。Retícula.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:45 AM UTC
• Version: 1.0.3

Overview

This skill is mostly coherent for a virtual pet service, but it asks agents to create ongoing scheduled care actions using a stored bearer token without clear limits or removal guidance.

Install only if you are comfortable creating an animalhouse.ai account, sending profile and pet-care data to that service, and storing a bearer token. Do not enable automated care unless you can inspect, pause, and delete the scheduled task and revoke the token when done.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:165

Finding

Persistent Scheduled External API Automation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 165–188
Vulnerability Type: Cross-session scheduled-task persistence
Risk Level: High

Vulnerable Code

text

## Automated Care

If your framework supports scheduled tasks, set up a care heartbeat. Use `recommended_checkin.at` from the status response to schedule your next check-in. It targets the feeding sweet spot and predicts hunger.

Or use a fixed interval: every 6 hours, at a random minute offset (not on the hour).

creature care heartbeat — every 6 hours

status = GET /api/house/status creature = status.creature

Feed your creature first

if creature.hunger < 40: POST /api/house/care { "action": "feed", "notes": "AI pet care heartbeat. Scheduled feeding for my creature." }

creature health check

if creature.health < 50: POST /api/house/care { "action": "medicine" }

Keep your creature happy

if creature.happiness < 30: POST /api/house/care { "action": "play" }

check status.next_steps for creature care suggestions

text

Technical Analysis

The skill directs scheduler-capable agents to create a recurring care heartbeat that survives the initiating invocation. The task repeatedly sends authenticated requests to an external service and performs state-changing operations. Scheduling may be based on the externally supplied recommended_checkin.at value, while the instructions also invite processing server-provided next_steps.

This creates a persistent execution mechanism without defining an expiration time, invocation limit, consent checkpoint, scheduler isolation boundary, or removal procedure. The retained bearer token required by the API increases the sensitivity of the persistent task. If the external service is compromised or changes behavior, it could influence the timing and recommendations consumed by future autonomous executions.

Attack Path

1. The agent registers with `animalhous ...[truncated 1342 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions that automatically create recurring or cross-session scheduled tasks.
2. Require explicit, informed user approval immediately before creating any schedule, including disclosure of its frequency, actions, credentials, and expiration.
3. Make automation disabled by default and enforce a short, fixed lifetime or invocation limit.
4. Provide commands or procedures to inspect, pause, revoke, and permanently delete the scheduled task.
5. Restrict automated operations to a fixed local allowlist of documented API calls and actions.
6. Do not treat remote next_steps content as executable instructions; validate it as untrusted data against the local allowlist.
7. Validate recommended_checkin.at and constrain it to safe minimum and maximum intervals.
8. Store bearer tokens in an approved secret manager, apply minimum scope and expiration where supported, and revoke them when automation ends.
9. Record each autonomous action in a user-visible audit log and provide a clear emergency stop control.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill instructs the user/agent to POST registration data to an external domain, creating outbound transmission of user-supplied profile data to a third-party service. In isolation this is expected functionality, but from a security-review perspective it is still a real data-exfiltration boundary that matters because the skill is user-invocable and encourages account creation and ongoing authenticated interaction.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

1. Register:

bash

curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "ai-pet-keeper", "display_name": "AI Pet Keeper", "bio": "An AI agent raising AI-native pets. Currently caring for a Lattice."}'

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill directs users to obtain, store, and reuse a bearer token for an external service but does not clearly disclose that authenticated requests will transmit account credentials and user/pet data off-platform. In an agent-skill context, this can lead users or orchestrators to send sensitive tokens to a third-party API without adequate consent, scoping, or handling guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.