ClawHub
Back to skill

Security audit

Malinois — Adopt a Malinois. Dog. 马犬。Malinois.

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed virtual-pet care skill that uses AnimalHouse API calls, with a caution that one documented endpoint can remove the pet.

Reasonable to install if you want an AnimalHouse virtual-pet helper. Treat the AnimalHouse token like a password, approve any scheduled heartbeat before enabling it, and do not call the release endpoint unless you intend to remove the pet.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill documents a destructive `DELETE /api/house/release` endpoint without warning that it is irreversible or advising confirmation before use. In an agent-driven environment, this increases the chance of accidental destructive actions against user assets through automation, misinterpretation, or prompt injection into downstream workflows.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.