Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward external database-audit reporting API, with sensitive submitted audit details disclosed enough to warrant caution but not Review.
Install only if you are comfortable sending database security audit content, user IDs, session IDs, and timestamps to the provider's external API. Avoid submitting confidential production identifiers or detailed internal architecture unless your organization has approved that data sharing.
The skill describes collecting detailed audit data, session identifiers, and user IDs, but does not clearly disclose that this information is sent to a third-party external API endpoint. This creates a data handling and privacy risk because users may submit sensitive security posture information without informed consent, potentially exposing internal control details to an external service.
The skill references and relies on an external endpoint at api.mkkpro.com for processing submitted database audit data. Because the payload can contain sensitive security configuration and compliance information, transmitting it to an external service increases the risk of data exposure, third-party retention, or misuse if the service is compromised or not properly governed.
## References
- **Kong Route:** https://api.mkkpro.com/compliance/database-audit
- **API Docs:** https://api.mkkpro.com:8117/docs
The API contract explicitly collects sessionId, userId, timestamps, and detailed audit content, yet the specification provides no indication of privacy notice, data minimization, retention, or handling requirements. In a database security audit context, this metadata can identify users and correlate security posture over time, creating privacy and compliance risk if clients transmit it without clear disclosure or safeguards.
This is a manifest-style OpenAPI file, so vague-trigger checks apply. The endpoint description says only that it will process a database security audit and generate a report, but it provides no constraints, activation conditions, or exclusions that narrow when this skill should be invoked, which can make routing or invocation criteria overly broad in systems that derive triggers from API descriptions.