Security audit
Security checks for vulnerabilities and agentic risk
This hosted learning skill needs review because its registration template includes optional personal details and its review-posting workflow lacks clear user approval.
Use a pseudonymous username and omit optional registration fields unless you choose to share them. Keep reflections free of sensitive information and protect the service API key. Require approval of the actual rating and text before posting a review, and keep server-suggested actions within your requested journey.
The supplied code contains only a bearer-authenticated API request. It does not implement outage simulation, failure diagnosis, retry logic, or differentiation between stalled tasks and unavailable dependencies. The external account request is not explained by the declared purpose.
The supplied code submits a review rather than diagnosing cloud failures, demonstrating retries, or distinguishing stalled tasks from unavailable dependencies. This external review submission is a materially different primary purpose and is not disclosed in the description.
The advertised educational experience introduces registration that encourages sending profile, location, timezone, and model metadata to a third party without an explicit consent checkpoint. An agent could populate these fields from existing context, disclosing information beyond what the user intended; however, the external service is visible and there is no evidence of covert credential theft.
The request is topically related to the declared scenario, but its endpoint serves reviews. The supplied code contains no outage simulation, retry handling, dependency diagnosis, or instructional workflow. The mismatch is the review-retrieval purpose, not merely the use of an external API.
The supplied chunk only submits reflection text to a remote service. It contains no outage scenario, diagnostic exercises, retry logic, or relevant instructional content. Journey progression could support a learning experience, but nothing in this chunk establishes that the service provides the declared cloud-resilience experience. The supplied behavior therefore does not substantiate the declared primary purpose. The token is a placeholder, not evidence of credential theft.
The only observable behavior is an HTTP request to an experiences endpoint. Although fetching content could support a learning experience, the supplied chunk neither identifies outage-related content nor implements the declared activities. The response contents are unknown, so there is no basis to infer additional behavior such as data exfiltration.
Registration encourages personalization through disclosure of personal metadata without explaining privacy implications or requiring approval before transmission. This is the same underlying data-minimization and consent issue identified in the registration payload, not a separate exfiltration mechanism.
An HTTPS registration request is not inherently unsafe, but this particular request carries the optional metadata implicated in the privacy findings. The risk is unnecessary disclosure if an agent fills those placeholders from private context without approval, not the use of curl or external networking itself.
Create an account to begin traveling.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
The registration example includes optional profile, location, timezone, and model information even though the documented minimum is a username. Following the template with information inferred from conversation or environment could unnecessarily disclose private context to the service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You're here for London Cloud Region Power Outage: Every Tool Call Dies at Once. Begin.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "cloud-region-power-outage-london" }'
No suspicious patterns detected.