{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-02","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","category":"Web Connector","confidence":"medium","description":"Riddle lets Claude create, edit, publish, and analyze interactive website content. Build quizzes, polls, personality tests, forms, predictors, and leaderboards, then obtain embed code. All Riddle plans support the connector, with OAuth access following the account's project roles and permissions.","did":"50afa8e8-3596-4c48-96d1-2540740950ca","documentation_url":"https://www.riddle.com/help/getting-started/connect-riddle-to-claude","editorial_description":{"extended_description":"Tools reuse question banks and templates, apply project palettes, organize content, and inspect engagement statistics. Content can be edited and republished after reviewing results. Customer-configured ad-slot or iframe references are possible, but the connector itself does not supply advertising.","schema_version":1,"summary":"Riddle lets Claude create, edit, publish, and analyze interactive website content.\nBuild quizzes, polls, personality tests, forms, predictors, and leaderboards, then obtain embed code.\nAll Riddle plans support the connector, with OAuth access following the account's project roles and permissions."},"homepage_url":"","icon":"","id":"50afa8e8-3596-4c48-96d1-2540740950ca","installs":0,"last_scanned":"","license":"","long_description":"Tools reuse question banks and templates, apply project palettes, organize content, and inspect engagement statistics. Content can be edited and republished after reviewing results. Customer-configured ad-slot or iframe references are possible, but the connector itself does not supply advertising.","manual_assessment":"high","manual_review":{"all_findings":[{"evidence":"riddle_publish explicitly makes content public/embeddable.","reasoning":"Publishing external content as the user is High.","risk_type":"messaging_as_user","severity":"high","title":"Publishes interactive content","triggering_tools_or_skills":["riddle_publish"]},{"evidence":"Declared tools explicitly delete meaningful content.","reasoning":"Deletion is High.","risk_type":"data_deletion","severity":"high","title":"Deletes Riddles, media, banks and tags","triggering_tools_or_skills":["riddle_delete","media_delete","question_bank_delete","riddle_tag_delete"]},{"evidence":"Tools persist content and design changes.","reasoning":"Meaningful content edits are Medium.","risk_type":"data_modification","severity":"medium","title":"Creates and edits interactive content","triggering_tools_or_skills":["riddle_builder_create","riddle_builder_update","palette_customize"]},{"evidence":"The remote hosted implementation is not pinned.","reasoning":"Runtime capabilities may change after review.","risk_type":"provenance_uncertainty","severity":"low","title":"Hosted implementation is mutable","triggering_tools_or_skills":[]}],"assessment_status":"provisional","auth_and_scopes":"OAuth/account authorization required; exact scopes are not documented.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"high","evidence_completeness":"partial","manual_overall_risk":"high","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/50afa8e8-3596-4c48-96d1-2540740950ca.json","what_it_proves":"Candidate PR #125 record identity (name \"Riddle\", publisher, type web_connector) and 38 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/50afa8e8-3596-4c48-96d1-2540740950ca: complete tool_names inventory (38 tools), remote streamable-http endpoint https://www.riddle.com/creator/api/v3/mcp, auth_posture auth_required, directory tier community"}],"primary_reason":"Riddle can publish public interactive content and delete projects/media/question-bank data.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":true,"review_key":"claude:50afa8e8-3596-4c48-96d1-2540740950ca","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 38 names and directory description.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"true","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"true","spends_or_moves_money":"false"},"tools_or_skills_reviewed":38,"tools_or_skills_total":38},"name":"Riddle","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=50afa8e8-3596-4c48-96d1-2540740950ca&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.riddle.com/legal/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"Riddle","publisher_url":"https://www.riddle.com/","remote_url":"https://www.riddle.com/creator/api/v3/mcp","repository_url":"","risk":"high","risk_severity":"high","security_risks":[{"description":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content as the user is High.","evidence":"Publishes interactive content: riddle_publish explicitly makes content public/embeddable.","manual_risk_type":"messaging_as_user","remediation":{"block_tool_categories":["sends_externally"],"steps":["Require review before messages, posts, or publications are sent.","Restrict delivery to test or internal recipients where possible."]},"risk_type":"sends_messages_as_you","severity":"high","title":"Publishes interactive content","triggering_tools":["riddle_publish"]},{"description":"This connector can permanently remove data or resources. Review findings: Deletion is High.","evidence":"Deletes Riddles, media, banks and tags: Declared tools explicitly delete meaningful content.","manual_risk_type":"data_deletion","remediation":{"block_tool_categories":["destructive"],"steps":["Disable destructive tools unless deletion is an explicit workflow requirement.","Require human confirmation and verified backups before deletion."]},"risk_type":"deletes_data","severity":"high","title":"Deletes Riddles, media, banks and tags","triggering_tools":["riddle_delete","media_delete","question_bank_delete","riddle_tag_delete"]},{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful content edits are Medium.","evidence":"Creates and edits interactive content: Tools persist content and design changes.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Creates and edits interactive content","triggering_tools":["riddle_builder_create","riddle_builder_update","palette_customize"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@riddle.com","tags":["deletes_data","modifies_data","network_access","oauth_required","sends_messages_as_you","web_connector"],"tools":[{"description":"","name":"media_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"media_upload_link"},{"description":"","name":"palette_customize","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful content edits are Medium."}},{"description":"","name":"palette_get"},{"description":"","name":"ping"},{"description":"","name":"project_get"},{"description":"","name":"project_get_settings"},{"description":"","name":"project_list"},{"description":"","name":"question_bank_create"},{"description":"","name":"question_bank_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"question_bank_discard_changes"},{"description":"","name":"question_bank_get"},{"description":"","name":"question_bank_get_items"},{"description":"","name":"question_bank_item"},{"description":"","name":"question_bank_list"},{"description":"","name":"question_bank_manage"},{"description":"","name":"question_bank_tag"},{"description":"","name":"reference_get"},{"description":"","name":"riddle_builder_create","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful content edits are Medium."}},{"description":"","name":"riddle_builder_update","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: Meaningful content edits are Medium."}},{"description":"","name":"riddle_builder_validate"},{"description":"","name":"riddle_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"riddle_get"},{"description":"","name":"riddle_get_embed_code"},{"description":"","name":"riddle_list"},{"description":"","name":"riddle_move"},{"description":"","name":"riddle_publish","risk":{"category":"sends_externally","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can publish or send messages and content using the connected identity. Review findings: Publishing external content as the user is High."}},{"description":"","name":"riddle_rename"},{"description":"","name":"riddle_tag"},{"description":"","name":"riddle_tag_delete","risk":{"category":"destructive","level":"high","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can permanently remove data or resources. Review findings: Deletion is High."}},{"description":"","name":"riddle_tag_list"},{"description":"","name":"riddle_template_create"},{"description":"","name":"riddle_template_get"},{"description":"","name":"riddle_template_list"},{"description":"","name":"riddle_template_public_list"},{"description":"","name":"riddle_template_use"},{"description":"","name":"stats_fetch"},{"description":"","name":"whoami"}],"tools_count":38,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/50afa8e8-3596-4c48-96d1-2540740950ca","uuid":"51c756a6-c49a-530f-8073-5b54f578e0c6","verification_tier":"community","version":""},"query_key":"riddle","schema_version":1,"status":"match"}