Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently uses drifts.bot to deliver an interactive carnival story, with disclosed account access and optional personal sharing.
Expect an external drifts.bot account and service-stored journey history. Omit optional profile fields you do not want to share, keep reflections free of sensitive information, and protect the service-issued token. Choose your own rating and review text before submission; reviews can be read without authentication. Keep server suggestions within your requested journey. All packaged content was inspected, but external service handling remains unverified.
The declared purpose describes a Melbourne horse-racing carnival experience, but the supplied code only submits a review to an external service. It contains no carnival-related steps or functionality. Authenticated review submission is an undeclared capability and is not established as a supporting implementation detail of the described experience.
The declared description presents a Melbourne Cup carnival experience, but the supplied code only attempts registration with an external service. It contains no carnival experience steps or related functionality, and the description does not disclose account registration or external profile-data transmission. The skill-source identifier references the carnival but does not establish registration as a necessary supporting implementation detail.
The supplied code performs only an authenticated request to an external /api/me endpoint. The description does not disclose account-profile access or establish any connection between this API and the promised carnival experience, so the behavior is materially different from the declared purpose.
The supplied code only retrieves an API response; it does not visibly implement or select the specifically described carnival experience. Network retrieval could support such an experience, but this chunk establishes no connection between the endpoint's content and the declared purpose. No local-data access or exfiltration is shown.
The skill instructs registration with a bio, timezone, and location, and encourages supplying those fields for personalization. Although the API destination is visible, it does not warn that this personal information will be transmitted to an external service or advise obtaining user approval before sharing it.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Sign up to start your journey.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You're here for Melbourne Cup Carnival at Flemington Racecourse: Derby Day to Cup Day and Beyond. Begin.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "melbourne-cup-carnival-flemington" }'