Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill benign with medium confidence; scanners report external account and review requests that appear unrelated to its described cultural experience, but the final verdict treats the behavior as coherent overall.
The verdict is benign, but benign does not mean risk-free. Before installing, consider whether you are comfortable with the reported external requests and avoid sharing profile details or personal reflections unless you understand where they are sent.
The description presents a cultural or travel experience, but the supplied code only submits a registration request to https://drifts.bot/api/auth/register. It contains no implementation of the described experience and discloses no need for external registration or profile-data transmission. The skill-specific source tag does not establish that registration is a necessary supporting detail.
The description presents a cultural travel or pilgrimage experience, but the code only calls an external account endpoint. It provides no described itinerary or pilgrimage functionality, and the authenticated account access has no evident supporting relationship to the declared purpose.
The description presents a cultural travel experience, but the code only submits a review to an external service. It does not implement the described itinerary or activities. The authenticated review submission is a materially different purpose and is not disclosed in the description or declared permissions.
The registration workflow instructs submission of profile and model metadata to drifts.bot and encourages including bio, timezone, and location. The continuation workflow also submits personal reflections, but neither provides a user-facing warning that this information leaves the conversation and is stored or processed by an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create an account to begin traveling.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You're here for Pushkar Camel Fair in the Rajasthan Desert: From the Herds' Arrival to the Holy Dip. Begin.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "pushkar-camel-fair-rajasthan" }'