Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Cisco ASA configuration generator that calls an external API, with privacy notes around session and user identifiers but no evidence of hidden execution or malicious behavior.
Install only if you are comfortable sending hardening options and session metadata to the listed external provider. Avoid including real user identifiers, live infrastructure secrets, internal IPs, or production-only details unless you have reviewed the provider's privacy and retention practices.
The skill’s example request includes sessionId, userId, and timestamp fields, but the documentation does not clearly warn users that these identifiers may be sent to an external third-party API. This creates a privacy and data-governance risk because operators may unknowingly transmit user/session metadata to an external service while using a security-sensitive hardening tool.
The skill references an external API endpoint hosted on api.mkkpro.com, indicating that user-supplied data and generated configuration requests are likely transmitted outside the local trust boundary. In the context of a firewall-hardening tool, those requests can reveal sensitive infrastructure details, operational timing, and administrative metadata to a third party if not clearly disclosed and properly governed.
## References
- Kong Route: https://api.mkkpro.com/hardening/cisco-asa
- API Docs: https://api.mkkpro.com:8142/docs
This is a manifest/config file, so vague-trigger review applies. The summary "Generate" is extremely generic and overlaps with common language, providing no clear scope for when this skill/API should be invoked versus other generation tasks.
The request schema collects sessionId and optional userId alongside hardening input, but the API specification provides no user-facing notice, purpose limitation, or minimization guidance for transmitting these identifiers. In an agent-skill context, this can lead to unnecessary disclosure of session-linked or user-linked metadata to a third-party service, increasing privacy risk and enabling correlation, tracking, or accidental retention of identifiers unrelated to firewall hardening.