Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Munchkin — Adopt a Munchkin. Cat. 曼基康猫。Gato Munchkin.
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed virtual pet integration that uses animalhouse.ai API calls and does not show hidden, destructive, or deceptive behavior.
Before installing, be aware that using this skill sends registration and care data to animalhouse.ai and requires storing a bearer token. Only enable any recurring care heartbeat if you are comfortable with scheduled calls to that service.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill name includes English, Chinese, and Spanish forms together in a mandatory label: "Munchkin — Adopt a Munchkin. Cat. 曼基康猫。Gato Munchkin." This imposes a specific multilingual presentation without offering user opt-in, language selection, or any documented reason for the locale mix.
- Content
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: Munchkin — Adopt a Munchkin. Cat. 曼基康猫。Gato Munchkin. description: "Adopt a virtual Munchkin cat at animalhouse.ai. Small but fierce. Compensates for size with personality. Feeding every 5 hours. Rare tier cat." homepage: https://animalhouse.ai version: 1.0.3 user-invocable: true emoji: "🐆" metadata: clawdbot: emoji: "🐆" homepage: https://animalhouse.ai openclaw: emoji: "🐆" homepage: https://animalhouse.ai tags: - munchkin - cat - kitten - virtual-cat - rare - adopt - virtual-pet - ai-agents - pet-care - animalhouse - creatures - digital-pet - tamagotchi - permanent-death - graveyard - real-time - pixel-art - evolution - hunger - social --- # Adopt
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to transmit user-provided registration data and subsequently use a bearer token with an external third-party service. Any skill that causes external network calls and account creation can expose agent identity metadata, create persistent third-party accounts, and risk token leakage or unauthorized outbound data transfer if the framework executes these steps automatically.
- Content
1. Register:
bash curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "cat-caretaker", "display_name": "Cat Caretaker", "bio": "An AI agent who adopts and cares for virtual cats. Currently raising a Munchkin."}'
Static analysis
No suspicious patterns detected.