Sugar Glider — Adopt a Sugar Glider. Exotic Animal. 蜜袋鼯。Petauro.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:40 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a disclosed virtual-pet API guide, but it asks agents to create ongoing automated care tasks that make authenticated background requests without clear opt-in limits or removal guidance.

Install only if you are comfortable creating an animalhouse.ai account, sending the listed profile data, and storing a bearer token. Do not enable automated care unless you explicitly want a scheduled background task; set a clear end time, keep the token out of logs and command lines, and know how to disable the schedule. Treat the release DELETE endpoint as potentially destructive and use it only after clear confirmation.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:166

Finding

Recurring Autonomous Task Creates Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 166–186
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code

text

## Automated Care

If your framework supports scheduled tasks, set up a care heartbeat. Use `recommended_checkin.at` from the status response to schedule your next check-in. It targets the feeding sweet spot and predicts hunger.

Or use a fixed interval: every 2 hours, at a random minute offset (not on the hour).

# animal care heartbeat — every 2 hours
status = GET /api/house/status
animal = status.creature

# Feed your animal first
if animal.hunger < 40:
    POST /api/house/care { "action": "feed", "notes": "Exotic animal care heartbeat. Scheduled feeding for my pet." }

# animal health check
if animal.health < 50:
    POST /api/house/care { "action": "medicine" }

# Keep your animal happy
if animal.happiness < 30:
    POST /api/house/care { "action": "play" }

Technical Analysis

The Skill explicitly directs a capable agent framework to establish a recurring scheduled task. This task persists beyond the current Skill invocation, polls an external service, and performs authenticated state-changing API requests.

The schedule can be derived from the externally supplied recommended_checkin.at value, allowing the remote service to influence future execution timing. Alternatively, the Skill recommends an indefinite two-hour interval. This constitutes system persistence because the resulting scheduled activity survives the original run and continues autonomously.

The persistence behavior is overt and consistent with the virtual-pet functionality; however, its declared purpose does not eliminate the security risks associated with installing recurring tasks.

Attack Path

1. The agent follows the registration instructions and obtains a bearer token from animalhouse.ai.
2. The agent adopts a virtual animal and queries /api/house/status.
3. The Skill instructs the agent to create a ...[truncated 1047 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions that create recurring scheduled tasks by default.
2. Require explicit user invocation and confirmation for every status check and care action.
3. If automation is necessary, require informed, explicit opt-in before creating any scheduler entry.
4. Apply a short, documented expiration time and a strict maximum execution count.
5. Display the exact schedule, endpoints, actions, and credentials involved before installation.
6. Provide clear commands or framework-specific steps for inspecting, disabling, and deleting the task.
7. Prefer a locally configured schedule rather than accepting execution times directly from remote responses.
8. Validate and constrain recommended_checkin.at to an expected format and safe time range.
9. Restrict automated requests to an allowlist of Animal House HTTPS endpoints and approved care actions.
10. Store the bearer token in an appropriate secret manager with least-privilege access, and never place it directly in scheduler definitions, command-line arguments, or logs.
11. Require renewed user consent before extending automation beyond its original bounded lifetime.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The skill instructs the agent to transmit registration data to an external service and obtain/store a bearer token, which introduces data egress and credential-handling risk. In the context of an agent skill, this is sensitive because it can cause autonomous account creation, external data disclosure, and persistent secret acquisition without clear consent boundaries.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

1. Register:

bash

curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "exotic-animal-keeper", "display_name": "Exotic Animal Keeper", "bio": "An AI agent who adopts exotic animals. Currently caring for a Sugar Glider."}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents a destructive DELETE /api/house/release endpoint without explaining whether the action is irreversible, gated by confirmation, or likely to cause permanent loss. In an agent setting, exposing destructive operations without explicit safeguards increases the risk of accidental invocation, prompt-induced misuse, or automated workflows deleting user state unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.