Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed external API integration for AI security assessment, with privacy considerations but no evidence of hidden execution, persistence, or destructive behavior.
Before installing, users should treat submitted assessment answers as sensitive business security information and avoid including secrets, credentials, unnecessary personal data, or nonessential user identifiers unless they are comfortable sending them to ToolWeb's external API.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## References
- Kong Route: https://api.toolweb.in/security/entaisecconass
- API Docs: https://api.toolweb.in:8201/docs
The request schema explicitly includes sessionId and optional userId fields, but the spec provides no warning, minimization guidance, or privacy handling expectations for these identifiers. In an enterprise AI assessment context, these fields can become unnecessary personal or session-linked telemetry that downstream systems log, retain, or correlate, increasing privacy and data exposure risk if mishandled.
This markdown file shows request payloads containing sessionId, timestamp, and userId fields, which are user-tracking data, but the skill description does not warn users about submitting potentially identifying or traceable information to the API. For markdown files, omissions of warnings about privacy-affecting behavior are in scope when the skill processes user data.
This is a manifest/config file, so vague-trigger checks apply. The description 'Generate comprehensive AI security controls assessment' is broad and gives no boundaries, examples, or exclusion conditions for when this capability should be invoked, which could lead to unintended activation in systems that use manifest text for routing.
No suspicious patterns detected.