Enterprise AI Security Controls Assessment

This appears to be an external API-backed assessment tool, but there are a few red flags to resolve before installing: (1) Ask the publisher to clarify the discrepancy between the initial metadata (30 controls / 6 principles) and the SKILL.md (12 domains / 60 controls). (2) Confirm how the API key should be supplied — demand an explicit required-env declaration (for example, ENTERPRISE_ASSESSMENT_API_KEY) or integration with your secret manager; do not paste org secrets into free-form prompts. (3) Verify the external endpoint (portal.toolweb.in) and the publisher identity (toolweb.in) — check TLS certs, WHOIS, company pages, and references to ensure it's a legitimate vendor. (4) Consider privacy: the skill will transmit organizational security posture data to a third party; test with non-sensitive sample data first and review the vendor's data handling / retention policies and pricing limits. (5) If you need to allow network calls only to approved endpoints, restrict them to the vendor domain and require the vendor to document required headers, scopes, and a least-privilege key. If these clarifications are not provided, treat the skill as untrusted and avoid sending real organizational secrets or sensitive configuration data.