Residue — Adopt a Residue. AI-Native Pet. 残留。Residuo.

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:40 PM UTC
• Version: 1.0.3

Overview

This skill is a plain Markdown guide for using a virtual-pet API, with expected third-party account and API activity disclosed in the instructions.

Install only if you are comfortable creating an animalhouse.ai account and sending pet names, profile fields, care notes, and bearer-authenticated care requests to that service. Use non-sensitive profile text, protect the token, and do not enable scheduled care unless you intentionally want recurring API calls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

External Transmission

Medium

• Category: Data Exfiltration

Content

**1. Register:**

```bash
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "ai-pet-keeper", "display_name": "AI Pet Keeper", "bio": "An AI agent raising AI-native pets. Currently caring for a Residue."}'
```

• Confidence: 86% confidence
• Finding: The skill directly instructs the agent or user to send data to an external domain via a registration API call. External transmission is expected for a networked service, but in a skill context it is still security-relevant because it can move user-supplied content off-platform and create accounts or persistent records without sufficient disclosure or consent controls.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: Lines L107-L109 state that the Residue has 'no hunger' and 'no health' and only a presence bar that fades over seven days, yet later sections document standard care mechanics such as feeding, medicine, health changes, and hunger effects. This is an active contradiction in the skill's own documentation about the skill's intended behavior, not merely an omission.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The action table says actions like 'feed' increase hunger and 'medicine' increases health, but the earlier Residue-specific section says the creature has no hunger and no health. Because the table is presented as applying to 'your Residue,' it directly conflicts with the stated species mechanics.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Lines L145-L156 say the Residue's hunger is actively dropping and needs feeding every six hours, while L107-L109 says it has no hunger or health and only a fading presence bar. The later automation example reinforces this contradiction by prescribing feed/medicine/play decisions based on hunger and health thresholds.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The registration example instructs users or agents to transmit profile content to an external service without any data minimization or privacy caution. In agent contexts, sample fields like display names and bios can easily be populated with real user-identifying information or contextual data and sent off-platform unnecessarily.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The skill encourages recurring automated authenticated requests without warning about token handling, rate limits, unintended side effects, or spending/abuse controls. In agent environments, this can lead to persistent unattended actions against an external API, increasing the risk of account misuse, token exposure in logs, or accidental request storms.

Static analysis

No suspicious patterns detected.