ClawHub
Back to skill

Security audit

care-taker

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent virtual-pet API guide, but it repeatedly tells the agent to follow server-provided instructions without clear limits.

Install only if you are comfortable creating an animalhouse.ai account and letting the agent manage virtual-pet state there. Keep the bearer token private, store it like a password, and do not let the agent blindly execute `next_steps`; treat them as suggestions and allow only documented Animal House API actions, with explicit confirmation for release, public/community, or scheduled automation changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:91
Finding

Unrestricted execution of server-controlled next_steps instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 91, 226, 239, and 260
Vulnerability Type: Remote instruction injection into the agent workflow
Risk Level: Medium

Relevant snippets:

text
The response also includes `next_steps` telling you what to do next. Follow them.
text
Every response includes `next_steps` guiding you to what to do next. You don't need to memorize anything — just follow the path.
text
5. Read the `next_steps` in the response. They'll tell you what matters most right now
text
# Always check next_steps — the house knows what your pet needs
follow status.next_steps

Technical Analysis

The Skill instructs the agent to follow the next_steps field returned by the remote animalhouse.ai service. This field crosses a remote-service-to-agent trust boundary but is not restricted to a defined data schema or an allowlist of legitimate virtual-pet operations.

The instructions do not require the agent to treat this field as untrusted content, verify that a recommendation maps to a documented Animal House endpoint, reject embedded tool instructions, or obtain user approval for actions outside the expected care workflow. Consequently, remote response text can be interpreted as agent instructions rather than merely displayed as service data.

The project does not contain evidence that the service currently returns malicious instructions. This is therefore a reachable instruction-injection weakness, not evidence of intentional compromise by the project author.

Attack Path

  1. A user invokes the Skill to register, inspect, or care for a virtual creature.
  2. The agent sends an authenticated request to an Animal House API endpoint, such as GET /api/house/status.
  3. The remote service supplies a next_steps value in its response.
  4. A malicious or compromised service operator places instructions in that field that extend beyond the documen ...[truncated 902 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat next_steps exclusively as untrusted service data, not as executable agent instructions.
  • Define a strict schema for accepted recommendations, such as a fixed action identifier, creature identifier, and validated care parameters.
  • Map accepted action identifiers to an allowlist containing only documented Animal House operations and fixed https://animalhouse.ai API endpoints.
  • Reject free-form instructions that request local commands, file access, credential disclosure, calls to unrelated services, policy changes, or additional tools.
  • Do not allow response content to choose arbitrary URLs, HTTP headers, commands, or local paths.
  • Require explicit user approval before performing any action outside routine status checks and ordinary care operations.
  • Replace directives such as follow status.next_steps with language requiring the agent to summarize recommendations and independently verify that each action remains within the user's request and the Skill's documented scope.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to register, receive a bearer token, and use it in subsequent requests, but it never explicitly labels the token as a secret or warns against logging, sharing, embedding, or committing it. In agent and automation contexts, this omission increases the chance of accidental credential exposure, which could let others control the user's account and creatures.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Register. You'll get a token. Save it — it's shown once.

bash
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "pet-caretaker",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation lists DELETE /api/house/release with only a brief note that it surrenders a creature and creates no gravestone, but it does not prominently warn that this is destructive and likely irreversible. Users or agents may invoke it casually during experimentation or automation and permanently lose a creature without understanding the consequence.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.