other
Warning
- Location
SKILL.md:78- Finding
Unnecessary Collection and External Disclosure of Personally Identifiable Birth Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Birth Chart
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-built for birth-chart generation, but it requires and sends a full identifying birth-data record to an external API without clear privacy or retention disclosures.
Install only if you are comfortable sending a person's full name, exact birth date, birth time, and birth location to the external service. Prefer using a nickname or pseudonym if the provider permits it, and check the provider's privacy, logging, retention, and deletion practices before submitting real personal data.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly collects highly identifying birth data (full name, date, time, and location of birth) and returns it in responses without any privacy notice, minimization guidance, retention statement, or handling safeguards. This creates privacy and compliance risk because birth details are persistent personal data that can be sensitive in some jurisdictions and can be combined for profiling or identity linkage.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The skill references an external API endpoint, meaning user-supplied birth data will be transmitted to a third-party service outside the local skill boundary. In the context of this skill, that transmission includes sensitive personal birth information, so the main danger is undisclosed third-party data sharing, dependency trust risk, and possible exposure if the external service has weak privacy or security controls.
- Content
md ## References - **Kong Route:** https://api.mkkpro.com/lifestyle/birth-chart - **API Docs:** https://api.mkkpro.com:8032/docs
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The schema collects personally identifiable and highly sensitive birth data including name, birth date, birth time, and birth location, but the API specification provides no privacy notice, consent language, retention policy, or handling guidance. In this context, the combination of fields is especially sensitive because precise birth data can uniquely identify a person and reveal location history, increasing privacy and profiling risks if mishandled or logged.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This manifest-like OpenAPI file defines a generic birth-chart generation operation but provides no explicit activation boundaries, negative examples, or narrow invocation context. In a skill-routing setting, the broad title and summary could make the skill eligible for loosely related astrology or personal-analysis requests without clear constraints.
- Content
Static analysis
No suspicious patterns detected.