Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward external API wrapper for generating VAPT learning roadmaps, with disclosed session tracking but limited privacy detail.
Before installing, understand that assessment details, session IDs, timestamps, and optional user IDs are submitted to the provider's external API. Avoid submitting sensitive personal or employment data unless you are comfortable with that provider's privacy and retention practices.
The sample request includes sessionId, userId, and timestamps, and the endpoint schema repeats these tracking fields as required inputs. The skill description does not warn users that assessment and session data may be stored, tracked, or processed, which is a missing user-facing warning for behavior that affects privacy.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## References
- **Kong Route:** https://api.mkkpro.com/career/vapt-intern
- **API Docs:** https://api.mkkpro.com:8058/docs
This manifest-style OpenAPI file uses generic descriptions such as "Generate Roadmap" and "Generate personalized VAPT intern roadmap" without any explicit constraints, exclusions, or examples showing when this capability should or should not be invoked. In a manifest/config context, that lack of specificity can make activation or routing logic overly broad.
No suspicious patterns detected.