Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward career-roadmap API integration, though users should know it sends career-profile details and session identifiers to an external service.
Before installing, treat this as a hosted API integration: send only the career, skills, and goals data needed for a roadmap, omit userId unless required, and review the provider's privacy terms if you plan to submit identifiable or sensitive professional information.
The skill describes collecting and analyzing personal career profile data, including experience, skills, goals, and session-based tracking, but provides no privacy notice, retention guidance, or warning about how submitted data may be handled. This can mislead users into sharing sensitive professional information without informed consent, increasing privacy and compliance risk.
The sample request explicitly transmits a session identifier, user identifier, and timestamp without any accompanying warning about tracking, correlation, or personal data handling. Example payloads strongly influence implementation, so this omission can normalize unnecessary identifier sharing and lead to privacy-invasive integrations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## References
- **Kong Route:** https://api.mkkpro.com/career/ai-ml-engineer
- **API Docs:** https://api.mkkpro.com:8055/docs
This is a manifest/config file, so vague-trigger checks apply. The operation is described only as "Generate Roadmap" and "Generate personalized AI/ML engineering roadmap" without any explicit trigger phrases, scope limits, or exclusion conditions, making activation criteria ambiguous in systems that derive skill invocation behavior from OpenAPI descriptions.
No suspicious patterns detected.