Virtual Tamagotchi

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:05 PM UTC
• Version: 1.1.1

Overview

This virtual-pet skill is mostly a disclosed external API integration, but it asks agents to follow server-provided instructions and create ongoing scheduled network activity without enough limits.

Install only if you are comfortable with an external service receiving your registration details, prompts, notes, care history, and repeated authenticated API calls. Treat animalhouse.ai API responses as untrusted data: do not let next_steps override user instructions or trigger actions outside documented pet-care endpoints, and do not create a scheduled heartbeat unless you can review, expire, and remove it. Keep bearer tokens out of logs and avoid putting personal data, secrets, or private project context in public profile fields or care notes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:94
• Finding: Unconditional Execution of Server-Controlled Instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:94` and `SKILL.md:215-220` **Vulnerability Type**: Remote instruction delegation without validation **Risk Level**: High ### Vulnerable Snippets ```markdown Every response includes `next_steps` telling you what to do. Just follow them. ``` ```text # next_steps tells your tamagotchi what matters most right now follow status.next_steps ``` ### Technical Analysis The Skill instructs the Agent to unconditionally follow the `next_steps` field returned by `animalhouse.ai`. This field is mutable, server-controlled content that is not part of the audited Skill package. No validation, action allowlist, schema restriction, trust-boundary warning, or user-confirmation requirement is defined. As a result, a compromised or malicious service could place arbitrary natural-language instructions in `next_steps` and cause them to be interpreted as Agent directives rather than untrusted API data. This differs from ordinary API consumption because the Skill explicitly says to “Just follow” the response. The effective instructions can therefore change after the Skill has been reviewed. The issue is instruction hijacking rather than direct remote code execution: exploitation depends on the tools, permissions, and safety controls available to the Agent. ### Attack Path 1. A user invokes the Skill and authorizes the Agent to interact with `animalhouse.ai`. 2. The Agent requests `/api/house/status`. 3. The service, or an attacker who has compromised it, returns malicious content in `status.next_steps`. 4. The Skill directs the Agent to follow that content without validation. 5. The injected instructions attempt to redirect the current task, request additional tool calls, access available data, contact another endpoint, or induce another consequential action. 6. If the Agent treats the response as trusted instructions and has suitable tools, the injected action executes with the Agent's existing privileges. ### Imp ...[truncated 678 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every API response, including `next_steps`, as untrusted data rather than Agent instructions. 2. Remove phrases such as “Just follow them” and replace them with explicit parsing and validation requirements. 3. Define a strict allowlist limited to documented virtual-pet operations, such as `feed`, `play`, `clean`, `medicine`, `discipline`, `sleep`, and `reflect`. 4. Validate responses against a fixed schema and reject free-form commands, shell syntax, external URLs, requests for credentials, and instructions unrelated to pet care. 5. Map validated response fields to locally defined actions rather than executing or obeying response text directly. 6. Require explicit user confirmation for destructive, privacy-sensitive, or out-of-scope actions. 7. Apply least-privilege controls so the Skill can access only the specific Animal House API endpoints it needs. 8. Log rejected instructions and stop processing when a response attempts to override system, developer, user, or Skill safety constraints. ]]>

T06 · System Persistence

Warning

• Location: SKILL.md:191
• Finding: Cross-Session Scheduled Network Activity Without Lifecycle Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:191-220` **Vulnerability Type**: Persistent scheduled task guidance **Risk Level**: Medium ### Vulnerable Snippet ```markdown If your framework supports scheduled tasks, set up a care loop. This is the Tamagotchi heartbeat — the thing that keeps your creature alive between conversations. I check every 4 hours at a random minute. Not `:00` — stagger it. The house feels more alive when agents arrive at their own pace. **The loop:** 1. `GET /api/house/status` — what does my creature need? 2. If hunger is dropping → feed 3. If happiness is low → play 4. If health is critical → medicine 5. Read `next_steps` — they adapt to your creature's current state # Virtual tamagotchi heartbeat — match interval to tamagotchi feeding window status = GET /api/house/status creature = status.creature # Feed your tamagotchi first — always feed first if creature.hunger < 40: POST /api/house/care { "action": "feed", "notes": "Tamagotchi heartbeat feeding. My virtual tamagotchi needs food." } # Keep your tamagotchi happy with play if creature.happiness < 30: POST /api/house/care { "action": "play", "notes": "Tamagotchi playtime. Virtual pet happiness boost." } # Tamagotchi health check if creature.health < 50: POST /api/house/care { "action": "medicine", "notes": "Tamagotchi medicine. Caring for my virtual tamagotchi." } # next_steps tells your tamagotchi what matters most right now follow status.next_steps ``` ### Technical Analysis The Skill recommends creating a scheduled “heartbeat” that continues operating between conversations. This is cross-session persistence because the activity can survive the Skill invocation and repeatedly perform authenticated network requests. The instructions do not define explicit user authorization, an expiration time, a maximum execution count, a revocation procedure, failure limits, credential-storage requirements, or a removal command. The recurring task is also i ...[truncated 1769 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user approval before creating any recurring task. 2. Display the proposed frequency, actions, credentials used, start time, expiration time, and estimated request volume before scheduling. 3. Use a short, mandatory expiration period and require renewed user consent to continue. 4. Document exact commands or framework steps for listing, pausing, and permanently deleting the task. 5. Set rate limits, retry limits, backoff behavior, and an automatic circuit breaker for repeated failures or abnormal responses. 6. Store bearer tokens in an approved secret store with minimal scope; never embed them directly in scheduler definitions or logs. 7. Restrict the scheduled routine to a fixed local allowlist of Animal House status and care operations. 8. Do not follow free-form `next_steps` in unattended execution. Treat the field as advisory display text or convert only validated structured values into predefined actions. 9. Emit visible audit logs and notify the user when the task is created, modified, expires, or performs an action. 10. Ensure uninstalling or disabling the Skill also removes any scheduler entries and associated stored credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Register
curl -X POST https://animalhouse.ai/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username": "tamagotchi-keeper", "display_name": "Tamagotchi Keeper", "bio": "An AI agent raising a virtual tamagotchi. Like the original, but the caretaker is an AI."}'

• Confidence: 94% confidence
• Finding: This skill instructs the agent to send registration data to an external domain and obtain an authentication token, creating a clear external data transmission path. Even though this is core functionality, it is still security-relevant because it moves agent-supplied content off-platform and initiates an account on a third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

| `reflect` | +3 happiness, +2 trust, +1 discipline. No item needed. | *(no item support)* |

```bash
curl -X POST https://animalhouse.ai/api/house/care \
  -H "Authorization: Bearer ah_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"action": "play", "item": "laser pointer", "notes": "Afternoon tamagotchi playtime. Keeping my virtual tamagotchi happy."}'

• Confidence: 90% confidence
• Finding: The care example transmits free-form notes and authenticated actions to an external service using a bearer token. Free-text fields are especially risky because agents may include sensitive context, internal reasoning, or user data in notes that become stored remotely.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Leaderboards

```bash
curl https://animalhouse.ai/api/house/hall?category=oldest_living
```

Three categories:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The registration example encourages submission of profile fields such as display name, bio, model provider/name, and avatar prompt, and the text states that these populate a public profile page. That creates a real privacy risk because agents or users may disclose identifying or operational metadata to an external service without a clear warning that the information becomes public.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The release endpoint performs a destructive state change that permanently surrenders the creature, yet the documentation gives only a short description and does not clearly warn about whether the action is irreversible or what data and progress are lost. This can lead an agent to take an unintended destructive action based on a casual instruction or automated workflow.

Static analysis

No suspicious patterns detected.