Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims: it sends a domain to an external subdomain-enumeration API and returns discovered subdomains, with no local code, persistence, or hidden behavior found.
Install only if you are comfortable sending target domains to the listed third-party API provider, and use it only for domains you own or are explicitly authorized to assess. Treat results as reconnaissance data that may be sensitive to your organization or client.
The skill explicitly enables deep subdomain enumeration, which is an active reconnaissance capability that can be misused against third-party domains. Omitting a clear warning about authorization, legality, and scanning impact increases the chance of unsafe or unauthorized use, especially because the skill is marketed to pentesters, bug bounty hunters, and red team operators.
The skill directs users to an external API endpoint, which means user-supplied target domains and related reconnaissance activity are transmitted to a third-party service outside the local skill context. In a security-reconnaissance tool, this is sensitive because it can leak assessment targets, create data handling/privacy concerns, and expose users to an external service with its own trust and security posture.
## References
- **Kong Route:** `https://api.mkkpro.com/security/subdomain-enumerator`
- **API Docs:** `https://api.mkkpro.com:8006/docs`
No suspicious patterns detected.