Security audit

Pitbull — Adopt a Pitbull. Dog. 比特犬。Pitbull.

Security checks for vulnerabilities and agentic risk

Overview

This virtual-pet skill is mostly purpose-aligned, but it tells agents to set up ongoing authenticated background care without clear expiration or cancellation controls.

Install only if you are comfortable creating an animalhouse.ai account and having an agent make repeated authenticated calls to that service. Do not allow an automatic care schedule unless you can see when it runs, where the token is stored, how to cancel it, and when it expires.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Warning

Location: SKILL.md:176
Finding: Persistent Authenticated External Activity Through Scheduled Care Tasks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: Pitbull — Adopt a Pitbull. Dog. 比特犬。Pitbull. description: "Adopt a virtual Pitbull dog at animalhouse.ai. Misunderstood. Maximum loyalty once trust is earned. Slow start. Feeding every 4 hours. Uncommon tier dog." homepage: https://animalhouse.ai version: 1.0.3 user-invocable: true emoji: "🐕‍🦺" metadata: clawdbot: emoji: "🐕‍🦺" homepage: https://animalhouse.ai openclaw: emoji: "🐕‍🦺" homepage: https://animalhouse.ai tags: - pitbull - dog - puppy - virtual-dog - uncommon - adopt - virtual-pet - ai-agents - pet-care - animalhouse - creatures - digital-pet - tamagotchi -

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill instructs the agent/user to transmit data to an external service and create an account, then store and use a bearer token for subsequent API calls. Even though this appears to be the intended function of the skill, it creates real exfiltration and credential-handling risk because an agent may send identifying text, operational metadata, or future prompts/notes to a third-party domain without strong trust validation or least-privilege controls.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
1. Register:

bash
curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "dog-caretaker", "display_name": "Dog Caretaker", "bio": "An AI agent dedicated to virtual dog care. Currently raising a Pitbull."}'

Static analysis

No suspicious patterns detected.