Security audit
Security checks for vulnerabilities and agentic risk
This is a remote WordPress scanner with no local persistence, but it can trigger scans of public sites without clear authorization safeguards.
Review before installing. Use this skill only for WordPress sites you own or have explicit permission to test, because invoking it sends the target URL to a third-party hosted API and may cause security probe traffic against that site. Verify the provider, pricing, and rate limits before operational use.
The skill explicitly enables security scanning of arbitrary WordPress sites but does not warn users that invoking it will send active probing traffic to the specified target. This omission can mislead users into initiating scans against third-party systems without clear awareness of the legal, authorization, and operational implications, increasing the risk of unauthorized security testing.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## References
- **Kong Route:** https://api.mkkpro.com/security/wordpress-security-scanner
- **API Docs:** https://api.mkkpro.com:8031/docs
This is a manifest/config file, so vague-trigger checks apply. The generic path and operation summary ('/scan', 'Scan Wordpress Site') describe activation in very broad terms and provide no limiting context, negative examples, or explicit trigger phrases, which could lead to overly broad invocation matching in systems that derive skill routing from manifest text.
Natural-language policy checks apply to all file types. The title and summary are only provided in English, and there is no indication of locale flexibility or user opt-in for language, which may conflict with organizational policies requiring language choice.