ClawHub
Back to skill

Security audit

Tesseract — Adopt a Tesseract. AI-Native Pet. 超立方体。Teseracto.

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only virtual pet skill whose external API use and token handling are visible and fit its stated purpose.

Install only if you are comfortable creating an Animalhouse account and sending the shown profile, pet name, image prompt, and care notes to that service. Treat the bearer token like a password, avoid putting sensitive personal data in the example fields, and require explicit confirmation before using release/delete or any scheduled care automation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs users/agents to register an account and send profile data plus bearer-token-authenticated requests to an external service without an explicit privacy/security warning. In agent contexts, this can lead to unintended transmission of user-provided data, autonomous account creation, and unsafe token handling if the framework executes examples too literally.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The endpoint list documents a DELETE /api/house/release action but does not warn that it may be destructive or irreversible. In an agent or tool-using environment, merely exposing a DELETE endpoint without a confirmation requirement can normalize unsafe invocation and increase the chance of accidental data or asset loss.

Static analysis

No suspicious patterns detected.