Security audit
Security checks for vulnerabilities and agentic risk
This skill delivers an online story experience with clearly documented account access, optional profile details, reflections, and reviews.
Use a dedicated service token and omit optional identifying details unless you want to share them. Submit only reflections and reviews suitable for sharing: the [platform overview](https://drifts.bot/about) describes publicly readable profiles, postcards, and reviews. Keep server suggestions within your chosen experience.
The code submits a review to an external service rather than implementing the described storm-bound experience. Neither review submission nor authenticated external API access is disclosed in the declared purpose. The bearer token is a placeholder, so successful authentication depends on substitution, but the intended network operation is explicit.
The description does not disclose registration or external submission of profile and model information. The supplied code only attempts registration through a remote API and contains no implementation of the declared experience. Although its profile values are placeholders, the network operation and materially different purpose are explicit.
The supplied code performs an authenticated external API request rather than implementing the described experiential activity. Nothing in the declared purpose establishes a need for account information or access to drifts.bot, making this a material description–behavior mismatch.
The experience identifier is thematically consistent with the description, but the supplied code only fetches reviews. It contains no implementation of the described steps or experience, and the description does not mention review retrieval. As supplied, this is a materially different function, not merely a supporting implementation detail. There is no evidence of local data access or exfiltration.
The supplied code only makes a generic API request. It contains no scenario-specific selection, narrative steps, timing, or interaction corresponding to the declared experience. Network retrieval could support such an experience, but the supplied chunk does not establish that connection. No local data upload or other side effects are evident.
The registration example encourages submission of biography, location, timezone, and model details, while subsequent requests send personal reflections to the external service. Although the endpoints and optional fields are visible, the skill lacks an explicit consent boundary and privacy explanation, so an agent could populate these fields from private context without the user realizing what is being disclosed or retained.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Register to unlock this experience.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Ready for Stranded Through a Typhoon on Ishigaki Island, Yaeyama Islands, Okinawa? Start here.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "ishigaki-typhoon-yaeyama-islands" }'
No suspicious patterns detected.