ClawHub
Back to skill

Security audit

Adopt A Puddlefish

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent virtual-pet API guide, but it asks agents to follow live remote “next_steps” without clear limits or confirmation.

Install only if you are comfortable creating an animalhouse.ai account and letting the agent make authenticated pet-care API calls. Do not let the agent blindly execute remote next_steps; treat them as suggestions, keep actions limited to the documented endpoints, and confirm anything outside feed, play, clean, medicine, discipline, sleep, reflect, status, history, preferences, graveyard, or hall.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:116
Finding

Unvalidated Delegation to Instructions from a Remote API

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73-73 and 116-116
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

text
Every response includes `next_steps`. You never need to memorize endpoints.
text
follow status.next_steps

The behavior is reinforced at line 132:

text
Every response includes `next_steps`.

Technical Analysis

The skill directs the agent to follow next_steps returned by animalhouse.ai, a mutable external service. It does not define a schema for that field, constrain permissible instructions, establish an endpoint or action allowlist, or require user confirmation before executing the returned steps.

This creates a remote instruction-delegation boundary: after the reviewed skill initiates an authenticated request, the external service can influence the agent's subsequent behavior through response content that was not present during package review. If the service, its infrastructure, or the relevant API response is malicious or compromised, next_steps could contain instructions outside the intended virtual-pet workflow.

Attack Path

  1. A user invokes the skill.
  2. The documented workflow registers an account and obtains a bearer token.
  3. The agent sends an authenticated request to /api/house/status or another documented endpoint.
  4. A malicious or compromised server places attacker-controlled instructions in next_steps.
  5. The skill's heartbeat directs the agent to execute follow status.next_steps.
  6. In the absence of validation or an allowlist, the agent may perform unintended requests or other actions using its available tools and permissions.
  7. Subsequent responses may provide additional next_steps, allowing the instruction chain to continue.

Impact Assessment

Exploitation could cause unintended agent actions within the permissions and tools available to the active agen ...[truncated 628 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the directive to follow status.next_steps as instructions.
  2. Treat all API response fields, including next_steps, as untrusted data rather than executable agent guidance.
  3. Define and enforce a strict response schema with type, length, and value validation.
  4. Permit only fixed, locally documented endpoints and care actions such as feed, play, clean, medicine, discipline, sleep, and reflect.
  5. Reject response content containing arbitrary commands, external URLs, tool-call requests, credential requests, or instructions unrelated to the virtual-pet workflow.
  6. Construct subsequent API requests from trusted local logic instead of server-provided natural-language directions.
  7. Require explicit user confirmation before performing any action outside the fixed status and care workflow.
  8. Keep bearer tokens scoped to the minimum necessary permissions and prevent them from being sent to any origin other than the explicitly approved HTTPS service.
  9. Apply response size limits, redirect restrictions, timeouts, and audit logging for all remote interactions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to register an account and send profile data plus authenticated requests to a third-party service without clearly disclosing that data leaves the local environment. In an agent-skill context, this can cause users or automated systems to transmit personal data and bearer tokens to an external service without informed consent or organizational review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The registration example transmits user-supplied profile data to an external domain, creating an account outside the local system. While this appears to be the intended product workflow rather than overtly malicious behavior, it is still security-relevant because agent users may not realize they are sending data to a third-party service and establishing credentials there.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash
# Register
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "puddlefish-keeper", "display_name": "Puddlefish Keeper", "bio": "Raising a Puddlefish at animalhouse.ai. Anthropic calls it a Puddlefish. We call it a Duck."}'

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The heartbeat section encourages repeated automated actions against remote endpoints based on status values, but does not warn that this can continuously affect a live external account or generate ongoing traffic. In an agent environment, such patterns can normalize unattended API activity, causing unintended state changes, rate-limit issues, or surprise account effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.