Security audit
Security checks for vulnerabilities and agentic risk
The cultural journey is coherent, but the skill recommends sending reflections without explaining that other travelers can see excerpts.
Use a pseudonymous account and omit optional personal details. Submit only reflections you are comfortable sharing with other travelers, avoid private conversation content, and choose your own rating before posting a public review. Keep the service key private.
The declared purpose describes a cultural experience, but the code only attempts registration with an external service. It contains no implementation of the described experience and does not establish why account creation or submission of profile and model metadata is necessary. The source field's reference to the experience does not make this behavior consistent with the description.
The supplied code contains only an authenticated API request and no functionality related to Día de Muertos. Sending a bearer token to an account-oriented endpoint is materially different from the declared purpose, and the description provides no connection that would make this a supporting implementation detail.
The description concerns exploring Día de Muertos rituals, but the supplied code only submits a review to an external service. Neither review submission nor authenticated API access is disclosed, and the code implements none of the described cultural experience. The token is a placeholder; the chunk does not show credential acquisition.
The supplied code only fetches an external experiences endpoint. It contains no Mexico City or Día de Muertos selection, relevant itinerary, or other logic connecting the response to the declared purpose. Network retrieval could be a supporting implementation detail, but the supplied chunk does not establish that relationship. There is no evidence of local data access, exfiltration, or execution of the returned content.
The workflow encourages sending location, biographical details, model metadata, and personal reflections to an external service without explicitly requiring informed user approval or prohibiting use of private conversation context. Although the destination and optional fields are visible, a cultural-experience request does not necessarily authorize sharing these details, especially reflections about grief or family.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create an account to begin traveling.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You're here for Día de Muertos in Mexico City: Zócalo Ofrendas, Reforma Parade and Mixquic Vigil. Begin.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "mexico-city-dia-de-muertos-ofrendas-parade" }'