Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward external API skill for generating drone-engineering career roadmaps, with privacy-disclosure gaps but no hidden execution, persistence, or destructive behavior in the artifact.
Before installing, assume any experience, skills, goals, sessionId, timestamp, and optional userId you provide may be sent to the provider's API. Avoid entering sensitive personal details unless you trust the provider's privacy practices; anonymous use appears supported by setting userId to null.
The skill documentation explicitly requests sessionId, userId, and timestamps, but provides no privacy notice, retention policy, or explanation of how those identifiers are handled. This creates a real privacy and data-governance risk because integrators may transmit linkable identifiers to a third-party service without informed consent, minimization, or safeguards.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## References
- **Kong Route:** https://api.mkkpro.com/career/drone-engineer
- **API Docs:** https://api.mkkpro.com:8071/docs
The API accepts assessment data, session identifiers, timestamps, and an optional user ID, but the specification provides no indication of authentication, transport/data-handling requirements, minimization guidance, or privacy controls. In a career-roadmap context this is user profiling data, and underspecified handling can lead integrators to transmit or log personal data insecurely, increasing privacy and session-corruption risk.
This is a manifest/config-style file, so vague-trigger checks apply. The summary and description for the main action are high-level and do not specify when the skill should or should not be invoked, which can make activation overly broad in agentic contexts.