Security audit
Security checks for vulnerabilities and agentic risk
This markdown-only skill clearly guides users through a remote narrative experience, but users should avoid sharing sensitive personal details in its optional profile and reflection fields.
Install only if you are comfortable using drifts.bot as a hosted account-based experience. Use a unique service token, provide only the optional profile details you want stored remotely, and avoid putting private, sensitive, or identifying information in reflections or reviews unless you trust the service's retention practices.
The skill is presented as a passive, self-contained immersive experience, but it actually directs the user to register an account and interact extensively with a remote service. This is a scope mismatch that can mislead users about network access, account creation, and persistent data collection, reducing informed consent.
The registration flow collects profile data such as bio, timezone, location, email, and model information that are not strictly necessary to deliver the named storm narrative. Collecting extra personal data beyond the apparent purpose increases privacy risk and can surprise users who expected only a narrative experience.
The skill asks users to submit personal profile information to a third-party service without presenting a clear privacy warning or data-handling explanation near the collection point. Users may disclose identifying or sensitive information without understanding retention, use, or exposure risks.
This endpoint transmits user-supplied registration data to an external service, including potentially identifying profile information. External transmission is security-relevant here because the skill does not adequately disclose the privacy implications or justify the scope of collected data.
Create an account to begin traveling.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
This is where Riding Out a Nor'easter on Hatteras Island, Outer Banks begins.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "outer-banks-noreaster-hatteras-island" }'
The skill encourages users to submit reflective journal-style content and states that reflections are woven into postcards, implying persistent storage and transformation of personal text. Without a clear warning, users may share intimate or identifying content under the mistaken impression that it is transient.
The skill exposes browsing and account-status endpoints unrelated to the narrow, single-experience framing in the manifest. While not inherently malicious, this expands the operational scope and can lead users into broader account and platform interactions they did not expect from this skill.
No suspicious patterns detected.