Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed external API helper for generating GKE Autopilot hardening configuration, with no local code execution or persistence, but users should avoid sending sensitive identifiers.
Before installing, confirm you are comfortable sending selected hardening options and request metadata to the listed third-party API. Use pseudonymous session IDs, omit userId/timestamp unless needed, and review generated Kubernetes manifests before applying them to a cluster.
The skill documents request fields such as sessionId, userId, and timestamp while presenting an external API workflow, but it does not warn users that these potentially identifying values will be transmitted to a third-party service. This creates a privacy and data-governance risk because users may unknowingly send internal identifiers or audit-correlated metadata outside their environment.
The skill references an external service endpoint, meaning users of the skill may send cluster hardening selections and associated metadata to infrastructure outside their trust boundary. In the context of a security-hardening tool, this is more sensitive because configuration choices, tenant identifiers, and usage patterns can reveal aspects of an organization's security posture and internal operations.
## References
- **Kong Route:** https://api.mkkpro.com/hardening/gke-autopilot
- **API Docs:** https://api.mkkpro.com:8145/docs
This is a manifest/config file, so vague-trigger rules apply. The description "Generate GKE AutoPilot hardening configurations" is generic and provides no limiting conditions, examples, or exclusions, which could lead to unintended invocation in systems that rely on manifest text for routing or activation.
No suspicious patterns detected.