Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently documents an online handoff practice journey, including account creation, stored reflections, and review features.
Use a pseudonym and omit optional personal fields unless you want to share them with drifts.bot. Keep secrets, private code, and sensitive handoff details out of reflections and reviews. Use the key issued by this service, choose your own review rating, and approve feedback before posting. Keep simulated quota behavior and remotely suggested actions within the journey you requested.
The supplied code implements review submission rather than the declared training workflow. Its external API interaction and credential use are not disclosed in the description or declared permissions, and no resource-monitoring or handoff-planning behavior appears in the chunk.
The declared purpose does not disclose external account registration or submission of profile and model information. The code performs a registration request rather than implementing the described resource-awareness and handoff exercises. Although the payload contains placeholders and successful registration is not established, the external registration behavior is explicit and materially different from the declared purpose.
The supplied chunk only fetches data from an external experiences endpoint. It contains no resource monitoring, quota-awareness logic, handoff planning, or 16-step practice workflow. No connection between this retrieval and the declared exercise is established, so the observed behavior materially differs from the description. The command does not show local-data exfiltration or execution of the retrieved content.
The supplied command performs an external account API request rather than implementing the described resource-awareness and handoff exercises. Nothing in the description connects that service or account lookup to the stated program, so the network access is not established as a supporting implementation detail. The token is a placeholder; the snippet does not show token discovery or additional behavior.
The supplied code only fetches an API response from a reviews endpoint. It contains no practice steps, resource-limit assessment, simulation, or handoff planning. Although the query identifier relates to the declared topic, the visible behavior does not implement that purpose. There is no evidence of local-data access or exfiltration.
The supplied chunk only performs an external HTTP request; it contains no resource-awareness exercises, quota tracking, or handoff-planning behavior. Fetching exercise content could be a supporting implementation detail, but neither the request nor any supplied response establishes that connection. There is no evidence of local data collection, exfiltration, or execution of the returned content.
The workflow encourages sending profile details to a third party and later storing free-form reflections, without a clear privacy notice or instruction to exclude sensitive context. In a coding-handoff exercise, an agent could include proprietary task details or personal information in those reflections; visible endpoints and optional fields reduce, but do not eliminate, this disclosure risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Sign up to start your journey.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Step into Weekly Usage Limit: The Seven-Day Window Closes and You Write the Handoff.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "weekly-usage-limit-handoff" }'
The manifest describes a specific 16-step simulation for resource awareness and disciplined handoff. These commands additionally submit ratings and free-text reviews to an external service and browse other experiences, neither of which is necessary to deliver the stated exercise or explicitly included in the manifest's scope.