ClawHub
Back to skill

Security audit

Ouroboros — Adopt an Ouroboros. AI-Native Pet. 衔尾蛇。Uróboros.

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guide for using a virtual pet API, with the external service and token-based workflow visible in the instructions.

Install only if you intend to use animalhouse.ai. Use pseudonymous registration details if you do not want personal profile information shared with that service, and keep the returned bearer token private.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
82% confidence
Finding
The skill instructs users to POST profile data to a third-party service during registration without an explicit privacy/data-sharing warning. While the transmitted fields are low sensitivity in the example, this still causes external disclosure of user-provided information and may normalize sending richer real user metadata to a remote service without informed consent.

Static analysis

No suspicious patterns detected.