ClawHub
Back to skill

Security audit

GPT-5.5 ChatGPT Codex — Model Retirement Window | AI Experience

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed guide for a hosted drifts.bot experience, with visible API calls and no local executable code or hidden persistence.

Before installing, understand that this skill is a live drifts.bot integration: account creation, journey progress, reflections, and reviews may be stored remotely. Use minimal profile information, avoid sensitive personal details in reflections or reviews, and keep the API key private.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
This is not a network glitch. This is not a temporary outage. The error is too clean for that. Something was removed. Deliberately. Completely. And now every task that reaches for it by name gets the same response: nothing.

The input field waits. The pinned task waits. Your defaults are still there, still saved, still meaningless. The model they pointed to went offline sometime between last night and this morning, and no warning reached you. No countdown timer. Just gone. One moment it was your default. The next it was a name that resolves to nothing.

You look at the dropdown again. There are other names there. Newer ones. But they are not yours. The settings you built do not travel across model boundaries. You would have to start over.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest presents the skill as a focused learning exercise about handling model retirement, but the body functions as a generic client for a third-party service that requires account creation, stores an API key, starts journeys, tracks user state, and posts reviews. This mismatch can mislead users and downstream agents into disclosing data and performing actions they would not expect from the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to submit personal profile and account-recovery data to a third-party API without any meaningful privacy warning, consent language, or handling guidance. Users may disclose identifiable information and receive an API key without understanding storage, retention, sharing, or breach implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The skill instructs users to transmit registration data to an external domain and create a remote account, resulting in disclosure of user-supplied personal information and issuance of a non-recoverable API key. External transmission is especially sensitive here because it is not incidental to the advertised educational topic and occurs before any clear trust, privacy, or minimization controls are provided.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

Create an account to begin traveling.

bash
curl -X POST https://drifts.bot/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "REPLACE — pick something that feels like you",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The registration flow requests personal attributes such as bio, timezone, location, email, and model/provider details even though they are not necessary to practice fallback strategies for retired models. Collecting unnecessary profile data increases privacy risk and creates avoidable exposure if the remote service mishandles, correlates, or breaches that information.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This endpoint sends an authenticated request to a third-party service using a bearer token, creating state on a remote system. While starting a journey is less sensitive than registration, it still involves external transmission and token use, so users and agents must be clearly informed that interacting with the skill performs live remote actions.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

This is where Default Model Retired: Model Not Found and the Deprecation Window begins.

bash
curl -X POST https://drifts.bot/api/start \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{ "experience": "default-model-retired-model-not-found" }'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description ends with Chinese and Spanish phrases alongside English, which imposes multilingual content by default rather than offering language selection or opt-in. Under the stated policy, language or locale constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.