ClawHub
Back to skill

Security audit

Flash Flood Desert Survival — Oman Wadi Shab | AI Experience

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to use a disclosed signup flow for an external service, with privacy cautions around what profile details the user chooses to submit.

Before installing, review the signup fields and provide only what you are comfortable sending to drifts.bot. Treat the returned API key like a password, store it securely, and avoid adding sensitive location, email, or biographical details unless needed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill asks the user to send profile data including bio, timezone, location, optional email, and model information to a third-party service, but it does not provide a clear privacy notice, data-use explanation, retention policy, or minimization guidance. This can lead users or agents to disclose unnecessary personal data to an external service without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
Sign up to start your journey.

```bash
curl -X POST https://drifts.bot/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "REPLACE — pick something that feels like you",
Confidence
90% confidence
Finding
This registration call transmits user-supplied profile data to an external domain, including potentially sensitive personal details and returns an API key, yet the skill provides no trust boundary warning or verification guidance for the remote service. Even over HTTPS, this is a security and privacy concern because agents may automatically exfiltrate personal data to a third party.

Static analysis

No suspicious patterns detected.