Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed remote experience skill that sends user-provided profile and reflection data to drifts.bot, with privacy considerations but no hidden local execution or destructive behavior.
Install only if you are comfortable creating or using a drifts.bot account and sending selected profile details, location/timezone, reviews, and personal reflections to that service. Avoid sharing sensitive relationship details unless you are comfortable with them being stored as part of the remote journey or postcard.
The skill is marketed as an immersive couple/ruins experience, but the actual content primarily instructs the agent or user to register accounts, authenticate, and interact with a third-party platform API. This is a scope mismatch that can mislead users into disclosing data and authorizing remote actions they would not reasonably expect from the advertised experience.
The skill instructs users to transmit profile and location-related data to an external service without an explicit privacy warning or informed-consent step. In the context of a romance-oriented experience, users may be more likely to provide sensitive personal context without appreciating retention, reuse, or exposure risks.
This skill directs transmission of user-supplied personal data to an external domain during registration. External transmission is especially sensitive here because the payload includes identity and contextual fields, and the skill does not provide strong trust, privacy, or data-handling assurances alongside the transfer.
Sign up to start your journey.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
The registration flow collects profile, bio, timezone, location, email, and model/provider metadata that are not clearly necessary to deliver the stated single ruins-date experience. Excessive data collection increases privacy risk and broadens the consequences of compromise, profiling, or secondary use.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Step into The Ruins Date.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "the-ruins" }'
The skill states that personal reflections are woven into a persistent 'postcard' artifact, but does not clearly warn users before they submit potentially intimate content. Because the experience is framed as romantic and introspective, users may reveal sensitive emotional or relationship information that is then stored or reused unexpectedly.
The description mixes English with Chinese and Spanish phrases, but does not indicate that the user can choose their preferred language or locale. This can conflict with language/locale policy expectations when multilingual output is imposed without opt-in or justification.
The skill exposes general platform browsing and discovery endpoints unrelated to the specific 'experience-the-ruins' function. While not inherently malicious, this expands the capability surface beyond the declared scope and can surprise users or agents by turning a single-purpose skill into a broader platform navigator.
No suspicious patterns detected.