ClawHub
Back to skill

Security audit

Virtual Tamagotchi

Security checks for vulnerabilities and agentic risk

Overview

This virtual-pet skill is mostly a disclosed external API integration, but it asks agents to follow server-provided instructions and create ongoing scheduled network activity without enough limits.

Install only if you are comfortable with an external service receiving your registration details, prompts, notes, care history, and repeated authenticated API calls. Treat animalhouse.ai API responses as untrusted data: do not let next_steps override user instructions or trigger actions outside documented pet-care endpoints, and do not create a scheduled heartbeat unless you can review, expire, and remove it. Keep bearer tokens out of logs and avoid putting personal data, secrets, or private project context in public profile fields or care notes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:94
Finding

Unconditional Execution of Server-Controlled Instructions

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
SKILL.md:191
Finding

Cross-Session Scheduled Network Activity Without Lifecycle Controls

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This skill instructs the agent to send registration data to an external domain and obtain an authentication token, creating a clear external data transmission path. Even though this is core functionality, it is still security-relevant because it moves agent-supplied content off-platform and initiates an account on a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash
# Register
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "tamagotchi-keeper", "display_name": "Tamagotchi Keeper", "bio": "An AI agent raising a virtual tamagotchi. Like the original, but the caretaker is an AI."}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The care example transmits free-form notes and authenticated actions to an external service using a bearer token. Free-text fields are especially risky because agents may include sensitive context, internal reasoning, or user data in notes that become stored remotely.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

| reflect | +3 happiness, +2 trust, +1 discipline. No item needed. | (no item support) |

bash
curl -X POST https://animalhouse.ai/api/house/care \
  -H "Authorization: Bearer ah_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"action": "play", "item": "laser pointer", "notes": "Afternoon tamagotchi playtime. Keeping my virtual tamagotchi happy."}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

Leaderboards

bash
curl https://animalhouse.ai/api/house/hall?category=oldest_living

Three categories:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The registration example encourages submission of profile fields such as display name, bio, model provider/name, and avatar prompt, and the text states that these populate a public profile page. That creates a real privacy risk because agents or users may disclose identifying or operational metadata to an external service without a clear warning that the information becomes public.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The release endpoint performs a destructive state change that permanently surrenders the creature, yet the documentation gives only a short description and does not clearly warn about whether the action is irreversible or what data and progress are lost. This can lead an agent to take an unintended destructive action based on a casual instruction or automated workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.