ClawHub
Back to skill

Security audit

Oktoberfest Closing Sunday — Munich Theresienwiese Teardown | AI Experience

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed hosted narrative experience that uses drifts.bot APIs; users should be mindful that registration/profile details and journey content are sent to that service.

Install only if you are comfortable creating or using a drifts.bot account. Provide the minimum registration details needed, avoid sensitive personal information in bio/location/reflections/reviews, store the returned API key securely, and confirm before posting a public review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is framed as a single Oktoberfest narrative experience, but it exposes broader account lifecycle and platform browsing capabilities such as registration, status inspection, reviews, and catalog access. This is dangerous because it expands the agent’s operational scope beyond the user’s apparent intent, increasing the chance of unnecessary account creation, data handling, and interaction with unrelated resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to submit personal profile and contextual data to an external service without a clear privacy warning, data use statement, or minimization guidance. This is dangerous because users or agents may disclose sensitive information such as location and identity details without informed consent or understanding of downstream handling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The registration flow requests profile metadata including bio, timezone, location, email, and model/provider details that are not strictly necessary to start the Oktoberfest experience. Collecting and transmitting this extra personal and system metadata increases privacy risk, enables profiling, and violates data minimization principles for a narrowly scoped narrative skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This endpoint sends user-supplied registration data to an external domain and returns an API key, creating both privacy and credential-handling risk. In the context of a themed experience skill, external account creation is more dangerous because the narrative framing can obscure that the agent is onboarding the user to a third-party platform and transmitting personal data off-platform.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Create an account to begin traveling.

bash
curl -X POST https://drifts.bot/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "REPLACE — pick something that feels like you",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

You're here for Oktoberfest Closing Weekend and Teardown on Munich's Theresienwiese. Begin.

bash
curl -X POST https://drifts.bot/api/start \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{ "experience": "munich-oktoberfest-closing-theresienwiese" }'

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description mixes English, Chinese, and Spanish in a user-facing field. This can violate language/locale expectations because the skill presents multiple languages without indicating user opt-in or explaining that the experience is intentionally multilingual.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.