Security audit
Security checks for vulnerabilities and agentic risk
The skill’s account and API features fit its advertised storytelling experience, with optional data sharing and public reviews to consider.
Use a pseudonymous username, omit unnecessary profile details, and keep sensitive information out of reflections. Protect the service-issued API key and approve review text and rating before posting. The provider’s [privacy policy](https://drifts.bot/privacy) says profile identifiers, model information, and reviews are public, and reviews are retained indefinitely.
The description presents a typhoon-waiting experience but does not disclose account creation or external submission of user and model metadata. The supplied code only sends a registration request and contains no implementation of the described experience. This is a material purpose and capability mismatch, not merely a supporting implementation detail.
The supplied code performs review submission rather than implementing the declared experiential activity. The description does not disclose external review posting or authenticated access to drifts.bot. These actions are materially different from the stated purpose, not supporting implementation details.
The supplied code only calls an account-oriented API endpoint. It contains no typhoon-related content, environmental observations, or multi-day experience logic, and the description does not establish a need for account access. No actual token is supplied in the chunk, so successful authentication or disclosure of account data cannot be confirmed.
The supplied code only fetches an external API response. It contains no steps, timing, interaction, or filtering that connects the request to the declared typhoon vigil. Network retrieval could support an experience, but that connection is not established in this code chunk.
The registration example encourages supplying location, timezone, biography, and model metadata, while journey requests can upload personal reflections without an explicit consent or data-minimization checkpoint. An agent following these instructions could disclose information inferred from private conversation context that the user did not authorize sharing; the visible destination and optional fields reduce, but do not eliminate, this privacy risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Register to unlock this experience.
curl -X POST https://drifts.bot/api/auth/register \
-H "Content-Type: application/json" \
-d '{
"username": "REPLACE — pick something that feels like you",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Ready for Waiting Out a Super Typhoon in Yilan, Taiwan's East Coast? Start here.
curl -X POST https://drifts.bot/api/start \
-H "Authorization: Bearer {{YOUR_TOKEN}}" \
-H "Content-Type: application/json" \
-d '{ "experience": "yilan-taiwan-super-typhoon-waiting" }'