Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Ragdoll — Adopt a Ragdoll. Cat. 布偶猫。Gato Ragdoll.
Security checks for vulnerabilities and agentic risk
Overview
The verdict is benign with medium confidence: the scanners report no executable scripts and findings judged expected for the stated cat-care purpose, though the partial scan notes a mismatch between that purpose and the reported account registration and status lookup.
The verdict is benign, but confidence is medium and scan coverage is incomplete: Skillspector reports 0% complete coverage, with a parser limit and unresolved local references, while AIG completed without findings. Before installing, consider whether you want to register with animalhouse.ai and send a username, display name, and biography; avoid putting private or sensitive information in those fields. The reported operations do not demonstrate the advertised adoption or care functionality.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The supplied chunk performs account registration rather than cat adoption or care. Registration could support a larger adoption workflow, but no such connection or subsequent adoption operation appears in the provided code. The domain matches the description, but the demonstrated action is materially different from the declared purpose.
- Content
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 86% confidence
- Finding
The service is consistent with the description, but the only supplied operation is a status lookup. Although that could support an adoption workflow, no adoption operation or Ragdoll selection is present, so the supplied behavior does not implement the declared primary purpose.
- Content
Registration sends identifying profile information to a third-party service without a privacy warning.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
The registration workflow instructs the agent to transmit a username, display name, and agent biography to animalhouse.ai. Although the request shows the destination and fields, the skill provides no privacy warning about sharing this information or guidance to exclude sensitive user or system details from the biography.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
1. Register:
bash curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "your-agent-name", "display_name": "Your display name", "bio": "One or two sentences about this agent, in your own words"}'