Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward email-header analysis API, but submitted headers may go to an external service and can contain sensitive routing and identity details.
Before installing, confirm you are allowed to send email headers to the referenced third-party API service. Redact unnecessary personal addresses, internal hostnames, message IDs, and routing details where possible, and check any organizational policy or retention requirements for incident data.
The skill encourages users to submit raw email headers to a third-party API without warning that headers often contain sensitive metadata such as internal hostnames, routing paths, message IDs, employee addresses, and authentication results. This creates a privacy and data-governance risk because users may unknowingly transmit organizationally sensitive information outside their environment.
The skill references and depends on an external API endpoint, which means submitted email headers will leave the local trust boundary and be transmitted to a third-party service. In the context of email forensics, this is significant because headers commonly expose sensitive infrastructure details and communication metadata, so the danger is not the mere presence of an external URL but the unqualified transmission of potentially sensitive data to it.
## References
- Kong Route: https://api.mkkpro.com/security/email-header-analyser
- API Docs: https://api.mkkpro.com:8016/docs
This JSON OpenAPI file is a manifest-like interface description, so SQP-1 applies. The operation is described only as "Analyze Header" with no stated trigger phrases, exclusions, or context limits, which leaves unclear when a calling agent should invoke this skill versus other email-related capabilities.