Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently delivers an online cyclone story, with disclosed account features and optional profile, reflection, and review sharing.
Use a pseudonymous profile, omit unnecessary personal details, and choose what reflections and reviews to submit. The service's [privacy policy](https://drifts.bot/privacy) says reviews are public and retained indefinitely. Keep its API key private and server-suggested actions within your intended experience.
The supplied code contains only an authenticated API request and implements none of the described cyclone experience. The description does not disclose account API access or establish why it would support the declared purpose. The token is a placeholder; the code alone does not demonstrate credential theft or successful access.
The supplied code submits a review rather than implementing the described cyclone experience. The external review submission and authenticated API access are not disclosed in the description and are not evident supporting implementation details. The token is a placeholder, so successful authentication depends on substitution, but the intended network operation is clear.
The supplied chunk implements a registration request rather than the described cyclone experience. Neither external account creation nor submission of profile and model information is disclosed in the description. Although its source identifier references the experience, that label does not establish registration as a necessary supporting detail. The placeholders do not demonstrate collection of real personal data or successful registration, but the attempted network operation is materially different from the declared purpose.
The API query references the same experience, but its function is to fetch reviews, not the described experiential content. The supplied chunk contains no steps or other behavior implementing the declared experience. This is a functional mismatch, not merely the use of networking as an implementation detail. There is no visible evidence of data exfiltration or additional side effects.
The agent-facing workflow encourages submission of location, timezone, biography, and personal reflections without requiring approval of the information being shared. Although the destination and optional nature of several fields are visible, an agent following the personalization guidance could populate them from private conversation context and disclose information beyond what the user intended for an immersive experience.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Sign up to start your journey.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Ready for Riding Out a Cyclone Landfall in Visakhapatnam, Andhra Pradesh? Start here.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "visakhapatnam-cyclone-landfall-shelter" }'