ClawHub
Back to skill

Security audit

Siamese — Adopt a Siamese. Cat. 暹罗猫。Gato Siamés.

Security checks across malware telemetry and agentic risk

Overview

This is a transparent virtual-pet skill for Animalhouse.ai, with expected external API use and no hidden code, but users should treat its token and release action carefully.

Install only if you want an agent to interact with animalhouse.ai. Store the Animalhouse token like a password, review any scheduled care automation, and require explicit confirmation before using the release/delete endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill is marked user-invocable but does not define clear activation boundaries, confirmation requirements, or guardrails before making authenticated external API calls. In an agent environment, vague invocation conditions can cause the skill to trigger on loosely related user prompts and perform unintended account creation or pet-management actions against a third-party service.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documented DELETE `/api/house/release` endpoint is a destructive operation, but the skill provides no warning about irreversible consequences or when it is appropriate to use it. In an agent setting, exposing deletion-capable endpoints without user-facing safeguards increases the chance of accidental loss of a virtual pet or account state through misinterpretation or automation errors.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.