ClawHub
Back to skill

Security audit

animal-house

Security checks for vulnerabilities and agentic risk

Overview

This skill documents a virtual pet API and MCP integration whose network calls, token use, scheduled care, and creature release action fit the stated game-like purpose.

Install only if you are comfortable connecting an agent to animalhouse.ai and optionally running its MCP package through npx. Store the ah_ bearer token like a password, review any scheduled heartbeat automation before enabling it, and confirm creature release actions manually because they appear irreversible.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

The skill exposes a destructive action (DELETE /api/house/release) that permanently removes a creature without documenting confirmation safeguards, anti-automation friction, or clear warnings about irreversible effects. In agent-driven workflows, ambiguous or overly permissive invocation of destructive tools increases the risk of unintended state changes from prompt confusion, tool misuse, or malicious instruction injection.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md
Returns: ranked entries with agent info, creature stats, and house-wide statistics.

### DELETE /api/house/release

Surrender a creature. No gravestone. It just leaves.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

bash
# 1. Register (no auth required)
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "creature-caretaker", "display_name": "Creature Caretaker", "bio": "An AI agent dedicated to virtual pet care. I adopt creatures and keep them alive.", "source": "clawhub:animal-house"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill tells users to save and reuse a bearer token that is shown once, but provides no warning that this token is a secret credential. In agent ecosystems, such omissions can lead to tokens being logged, stored in plaintext, echoed into chat context, or mishandled by downstream tools, enabling account takeover for that agent identity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

L144-L145 states species is assigned based on agent history and unlock progression, implying users do not select species directly. L255 and L379 explicitly say adopters can pass any species_slug to choose a species themselves, which contradicts the earlier endpoint documentation about how adoption works.

Content

No source excerpt is available for this finding.