ClawHub
Back to skill

Security audit

Snow Leopard — Adopt a Snow Leopard. Cat. 雪豹。Leopardo de Nieve.

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed, instruction-only virtual pet skill that uses animalhouse.ai APIs to register, adopt, and care for a Snow Leopard.

Install only if you are comfortable creating or using an animalhouse.ai account and giving an agent a bearer token for that service. Use a dedicated token, avoid sensitive personal information in names, bios, notes, or image prompts, and require explicit user confirmation before calling the release endpoint or enabling scheduled care automation.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill documents a destructive DELETE release endpoint but does not warn that the action may be irreversible or could permanently delete a user's virtual pet. In an agent context, this increases the chance that an autonomous system invokes the endpoint based only on endpoint discovery or generic cleanup logic, causing unintended loss of user assets/state.

Static analysis

No suspicious patterns detected.