Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed remote experience skill that uses drifts.bot APIs for account-based progress, with privacy-sensitive optional fields users should minimize.
Before installing, treat this as a third-party hosted service, not a local-only skill. Use a pseudonym, omit optional bio, email, location, and model details unless you are comfortable sharing them with drifts.bot, and remember that reflections, progress, and reviews may be stored remotely.
The description reads like general aspirational guidance about handling frustration and resilience rather than a narrowly scoped trigger or invocation condition. In a manifest file, this kind of broad phrasing can overlap with many ordinary conversations about stress or API issues, increasing the risk of unintended invocation.
The skill is presented as a narrowly scoped rate-limit resilience experience, but it actually onboards users into a broader remote platform with accounts, journeys, reviews, profiles, and catalog browsing. This scope mismatch can mislead users and reviewers about what data is collected and what actions are performed, increasing the risk of unintended data sharing and over-broad trust in the service.
The skill instructs users to submit profile and location-related data to a third-party service without a clear privacy warning in the skill content. In a skill context, users may assume actions are local or minimally scoped, so omission of privacy disclosures makes the external data transfer more dangerous and undermines informed consent.
This command transmits user-supplied registration data to an external domain, including potentially sensitive profile fields and metadata about the user's AI provider/model. External transmission is risky here because the skill is framed as an experiential exercise, not as third-party account enrollment, so users may not expect their data to leave the environment.
Sign up to start your journey.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
The registration flow requests personal data such as bio, email, timezone, location, and model information even though the stated purpose is practicing a rate-limit resilience scenario. Collecting unnecessary profile data violates data minimization and increases privacy risk if the service is compromised, misused, or retained longer than expected.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You're here for Model at Capacity: 429 Rate Limits, Failed Retries and a False Spend-Limit Lockout. Begin.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "model-at-capacity-429-rate-limit" }'
The manifest presents this as one specific experience about model-capacity and rate-limit frustration, but the file also exposes endpoints to list and preview all experiences on the platform. That cross-experience discovery capability is not necessary to carry out the stated purpose of this skill.
No suspicious patterns detected.