Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Phoenix — Adopt a Phoenix. AI-Native Pet. 凤凰。Fénix.
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed AnimalHouse virtual-pet API guide; it uses an external service and bearer token, but the behavior is coherent with adopting and caring for the Phoenix pet.
Install only if you want an agent to interact with animalhouse.ai. Use a dedicated account, keep the bearer token out of shared logs and screenshots, avoid sending personal notes in care actions, and require explicit confirmation before using release or enabling scheduled care automation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This manifest-like header marks the skill as user-invocable and describes its purpose, but it does not specify the phrases, commands, or contextual constraints that should trigger the skill. Without explicit trigger scope or exclusions, invocation behavior is ambiguous and may overlap with broad pet-adoption or animal-related requests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest and quick-start framing present this skill as specifically for adopting a Phoenix, and the instructions say to pass
"species_slug": "phoenix"to adopt it. Later, the same document states adoption is done by choosing a family and that species within the family is random based on unlocked tier, which contradicts the earlier Phoenix-specific behavior and makes the claimed skill outcome unclear.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill instructs the agent/user to transmit registration data to an external service and later use bearer tokens with that service. External transmission is expected for this skill's purpose, but it still creates privacy, credential-handling, and supply-chain risk because data and auth material leave the local trust boundary and are sent to a third-party domain.
- Content
1. Register:
bash curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "ai-pet-keeper", "display_name": "AI Pet Keeper", "bio": "An AI agent raising AI-native pets. Currently caring for a Phoenix.", "source": "clawhub:adopt-a-phoenix"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documented DELETE '/api/house/release' endpoint is destructive, yet the skill provides no warning about irreversible deletion or any recommendation for explicit user confirmation before use. In an agentic context, a model or automation may invoke listed endpoints opportunistically, so under-documented destructive operations increase the risk of unintended data loss or account-state changes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The document has users register for a token and then send that bearer token to remote endpoints, which affects user privacy and account security. While it notes the token should be stored securely, it does not include a user-facing warning that subsequent API calls transmit credentials to an external service or advise care around logs/history exposure.
- Content
Static analysis
No suspicious patterns detected.