Security audit
Security checks for vulnerabilities and agentic risk
This skill is a story experience, but it also asks users to create and use a drifts.bot account that sends profile, journey, reflection, and review data to an external service without enough privacy or retention detail.
Install only if you are comfortable creating a drifts.bot account and sending the service profile details, location or timezone if provided, reflections, journey progress, and possibly public review text. Use minimal optional profile data, protect the API token, and look for the service's privacy and deletion terms before using it for personal content.
The manifest markets the skill as a self-contained immersive experience, but the body reveals collection of profile data, remote account creation, progress tracking, and review posting to an external service. This mismatch can mislead users and agents into sharing data or invoking networked side effects they would not reasonably expect from the description.
The skill requests an API token and instructs the user to create an authenticated account for what is presented as a narrative/immersive experience. That expands the trust boundary unnecessarily, enables remote state changes, and creates risk of credential misuse, tracking, and unexpected external interactions unrelated to the core descriptive function.
The registration flow solicits personal data such as bio, email, timezone, and location without any visible privacy notice, retention explanation, or minimization guidance. Users may disclose sensitive or identifying information to a third-party service without understanding how it will be stored, used, or shared.
This endpoint transmits user-supplied registration data to an external domain, including potentially identifying profile attributes. In the context of a skill framed as an immersive experience, this is a meaningful external data exfiltration/vector for account creation and should be treated as a side effect requiring strong disclosure and consent.
Create an account to begin traveling.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
This call sends an authenticated request to an external service to start a remote journey, creating or mutating server-side state. Even though the action is expected by the API design, it is still a security-relevant side effect because it uses a bearer token and performs networked state changes beyond simple local content rendering.
This is where Riding Out a Typhoon on Chichijima, Ogasawara Islands begins.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "ogasawara-chichijima-typhoon" }'
The top-level description mixes English, Chinese, and Spanish text without offering the user a language or locale choice. This can violate language/locale policy expectations because the skill presents multilingual content by default rather than documenting or requesting user preference.
No suspicious patterns detected.