Security audit
Security checks for vulnerabilities and agentic risk
The skill’s documented online service supports the guided experience, with optional sharing of profile details, reflections, and reviews.
Use a drifts.bot-issued key and share only profile details and reflections you want that service to receive. You can omit reflections. Check its privacy practices before sharing sensitive thoughts, and choose your own review rating and text before posting. Server-side retention and visibility were not established by this artifact review.
The code submits a review to an external service rather than providing the described contemplative experience. Neither the network submission nor credential use is disclosed by the declared purpose or permissions. The review text is a literal payload value, not an instruction followed in this assessment.
The code performs an authenticated external API request rather than implementing the declared cultural or contemplative experience. Nothing in the description establishes a need for this endpoint or credential use, so the behavior is materially unrelated rather than a supporting implementation detail.
The declared purpose describes a cultural and contemplative experience, but the supplied shell command attempts to register an account at drifts.bot. Neither account creation nor sending profile and model information to an external service is disclosed or evidently necessary for that experience. The placeholders limit the data actually submitted as written, but do not change the command's unrelated registration purpose.
The supplied code only fetches a remote API response; it contains no implementation of the described experience or selection of relevant content. Although an API request could support such an experience, that connection is not established in this chunk. No data exfiltration or execution of downloaded content is shown.
The supplied chunk performs an external, authenticated submission rather than presenting the described experience. A journey API could support a guided experience, but nothing in this chunk connects the request to the declared setting or activities, and the description does not disclose remote reflection submission. The payload is a fixed prompt, not an actual personal reflection, and the token is a placeholder; the code does not establish that personal information or a real credential has been transmitted.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Sign up to start your journey.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You're here for Diwali Night at the Golden Temple, Amritsar: Bandi Chhor Divas Until Dawn. Begin.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "amritsar-golden-temple-diwali-night" }'
The workflow encourages personal reflections and sends them to a third-party service without an explicit privacy notice or consent checkpoint. In a contemplative experience, these reflections may reveal sensitive beliefs or emotions; the visible API example makes transmission discoverable but does not ensure the user knowingly authorizes disclosure.