Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed API-backed Docker hardening generator, with a privacy caveat because requests go to an external service with session metadata.
Use this only when you are comfortable sending Docker hardening choices and request metadata to the provider's API. Avoid including secrets, private hostnames, internal topology, or account identifiers in option values unless you trust the provider's retention and privacy practices.
The skill requests sessionId, userId, and timestamp and describes use for tracking and audit purposes, but it does not clearly warn that these identifiers and request metadata may be sent to an external third-party API endpoint. This creates a transparency and privacy risk because users may unknowingly disclose operational or potentially identifying metadata outside their environment.
The skill explicitly references an external API endpoint, which means user-supplied hardening options and associated metadata will leave the local trust boundary. In this context, the danger is not inherently code execution but potential leakage of infrastructure details, identifiers, and usage metadata to a third party, especially since the skill markets itself as a security tool that may be used with sensitive deployment information.
## References
- **Kong Route:** https://api.mkkpro.com/hardening/docker
- **API Docs:** https://api.mkkpro.com:8136/docs
This is a manifest-style file, so vague-trigger review applies. The top-level description states a broad capability as a 'Professional Docker Security Configuration Generator' without clarifying when this skill should or should not be invoked, and it provides no exclusion conditions or narrowly scoped trigger phrases.
For markdown and manifest-style descriptions, missing-warning findings apply when the skill omits warnings about privacy-relevant behavior. The schema collects sessionId, optional userId, and timestamp, but the API description provides no user-facing notice about handling identifiers or associated privacy considerations.
No suspicious patterns detected.