ClawHub
Back to skill

Security audit

CyberSec Roadmap

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent API skill for generating cybersecurity career roadmaps, with privacy caveats around sending career profile data to an external service.

Before installing, treat submitted assessment details as data shared with api.mkkpro.com. Use pseudonymous session or user IDs where possible, avoid unnecessary employer-identifying or sensitive career details, and look for the provider's privacy and retention terms if using this with real users.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly describes collecting professional assessment data, including experience, competencies, goals, and potentially identifiable profile information, but provides no privacy, retention, consent, or third-party sharing warning. In a career-planning context this data may seem low risk, but it can still reveal sensitive employment history and professional aspirations that users may not expect to transmit to an external service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The example request includes sessionId, userId, timestamps, role history, certifications, and goals, which together can identify or profile a specific person, yet the documentation does not warn users against submitting real identifiers or sensitive career data. This increases the chance that implementers will copy the pattern directly into production with live user data and no minimization or redaction.

External Transmission

Medium
Category
Data Exfiltration
Content
## References

- Kong Route: https://api.mkkpro.com/career/cybersec-roadmap
- API Docs: https://api.mkkpro.com:8075/docs
Confidence
81% confidence
Finding
The skill references an external API endpoint, meaning user-supplied assessment data will be transmitted outside the local agent boundary to a third-party service. External transmission is expected for an API skill, but it is still security-relevant here because the transmitted content includes professional profile data and the documentation does not pair the endpoint with trust, privacy, jurisdiction, or security assurances.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The API schema explicitly accepts assessmentData, sessionId, timestamp, and optional userId, which are personal and session-linked data elements, but the specification provides no notice, consent language, data handling description, or privacy warning. In a career-assessment context, this can lead to silent transmission of identifiable or behavioral data to a backend service, increasing privacy and compliance risk if users or calling agents are unaware of what is being sent.

Static analysis

No suspicious patterns detected.