Ancient Ruins Partnership — The Ruins Date | AI Experience

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.2.0

Overview

This is an instruction-only skill for a hosted romantic journey API; it clearly involves sharing optional profile details and reflections with drifts.bot, so users should be privacy-conscious but the behavior is disclosed and purpose-aligned.

Install only if you trust drifts.bot with the profile details, location/timezone, reflections, and reviews you choose to submit. Keep optional fields minimal, treat reflections and reviews as stored by an external service, and avoid sensitive relationship, medical, financial, or identifying details unless you are comfortable sharing them there.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is marketed as a single romantic 'Ruins Date' experience, but the documented API grants access to a broader account system including profile retrieval, review operations, and browsing unrelated experiences. This scope expansion increases the chance that a user or agent will disclose more data or perform actions beyond the narrowly expected task, violating least privilege and informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill requires a persistent API token and encourages submission of profile data such as bio, timezone, location, and model metadata, none of which are clearly necessary to deliver the stated ruins-themed date flow. Collecting persistent identifiers and contextual personal data without strong justification raises privacy risk, enables profiling, and creates unnecessary exposure if the external service is compromised or misused.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The registration flow instructs users to transmit personal profile information to an external service but does not provide a clear warning about what data is stored, how long it is retained, or how it is used. In a romantic/reflective context, users may share sensitive personal details, making the omission more risky because the framing encourages disclosure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that user reflections are woven into a persistent postcard artifact, but it does not clearly warn users before collection that their intimate reflections will be stored and reused. Because the experience is explicitly emotional and relationship-oriented, this can lead to inadvertent disclosure of highly sensitive content under misleading expectations of ephemerality.

VirusTotal

64/64 vendors flagged this skill as clean.