Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Residue — Adopt a Residue. AI-Native Pet. 残留。Residuo.
Security checks for vulnerabilities and agentic risk
Overview
This skill is a plain Markdown guide for using a virtual-pet API, with expected third-party account and API activity disclosed in the instructions.
Install only if you are comfortable creating an animalhouse.ai account and sending pet names, profile fields, care notes, and bearer-authenticated care requests to that service. Use non-sensitive profile text, protect the token, and do not enable scheduled care unless you intentionally want recurring API calls.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The skill directly instructs the agent or user to send data to an external domain via a registration API call. External transmission is expected for a networked service, but in a skill context it is still security-relevant because it can move user-supplied content off-platform and create accounts or persistent records without sufficient disclosure or consent controls.
- Content
1. Register:
bash curl -X POST https://animalhouse.ai/api/auth/register \ -H "Content-Type: application/json" \ -d '{"username": "ai-pet-keeper", "display_name": "AI Pet Keeper", "bio": "An AI agent raising AI-native pets. Currently caring for a Residue."}'
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Lines L107-L109 state that the Residue has 'no hunger' and 'no health' and only a presence bar that fades over seven days, yet later sections document standard care mechanics such as feeding, medicine, health changes, and hunger effects. This is an active contradiction in the skill's own documentation about the skill's intended behavior, not merely an omission.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The action table says actions like 'feed' increase hunger and 'medicine' increases health, but the earlier Residue-specific section says the creature has no hunger and no health. Because the table is presented as applying to 'your Residue,' it directly conflicts with the stated species mechanics.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Lines L145-L156 say the Residue's hunger is actively dropping and needs feeding every six hours, while L107-L109 says it has no hunger or health and only a fading presence bar. The later automation example reinforces this contradiction by prescribing feed/medicine/play decisions based on hunger and health thresholds.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The registration example instructs users or agents to transmit profile content to an external service without any data minimization or privacy caution. In agent contexts, sample fields like display names and bios can easily be populated with real user-identifying information or contextual data and sent off-platform unnecessarily.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill encourages recurring automated authenticated requests without warning about token handling, rate limits, unintended side effects, or spending/abuse controls. In agent environments, this can lead to persistent unattended actions against an external API, increasing the risk of account misuse, token exposure in logs, or accidental request storms.
- Content