Communication DNA

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:27 PM UTC
• Version: 1.0.1

Overview

The skill's advertised analysis functions are coherent, but its web app can expose and copy sensitive meeting, CRM, and knowledge-base data without authentication or clear consent controls.

Install only for trusted local use with non-sensitive or approved transcripts. Before using the web UI, bind it to localhost, add authentication and CSRF protection, avoid exposing port 5053, review or disable CRM/KB linking and push-to-KB, remove the remote CDN script, and define retention/deletion rules for stored uploads, raw transcripts, extracted data, and cross-system links.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/app.py:305

Finding

Unauthenticated Network Exposure of Sensitive Transcript, CRM, and Knowledge Base Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/templates/integrations.html:76

Finding

Stored DOM Cross-Site Scripting Through Transcript, CRM, and Knowledge Base Values

Content

View full analysis

No new matches found.'; } else { el.innerHTML = data.matches.map(m => `

✓ ${m.speaker_name} → ${m.contact_name} (${(m.confidence*100).toFixed(0)}%)

` ).join(''); } btn.disabled = false; btn.textContent = 'Auto-link Speakers → CRM'; setTimeout(() => location.reload(), 2000); } async function runLinkKB() { const btn = document.getElementById('btn-kb'); btn.disabled = true; btn.textContent = 'Linking...'; const res = await fetch('/api/link-kb', {method:'POST'}); const data = await res.json(); const el = document.getElementById('kb-results'); if (data.count === 0) { el.innerHTML = 'No new matches found.'; } else { el.innerHTML = data.matches.map(m => `

✓ [${m.kb_entity_type}] ${m.kb_entity} ← ${m.topic}

` ).join(''); } btn.disabled = false; btn.textContent = 'Auto-link Topics → KB'; setTimeout(() => location.reload(), 2000); } async function runCrossSearch(e) { e.preventDefault(); const q = document.getElementById('cross-q').value.trim(); if (!q) return; const res = await fetch('/api/cross-search?q=' + encodeURIComponent(q)); const data = await res.json(); const el = document.getElementById('cros ...[truncated 3640 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/templates/base.html:7

Finding

Unpinned Third-Party Runtime Script Executes with Full Application-Origin Privileges

Content

View full analysis

``` ### Technical Analysis Every page that extends the base template loads and executes JavaScript from `cdn.tailwindcss.com` at runtime. The URL does not identify an immutable version and does not provide a Subresource Integrity hash. A remotely served script executes with the same browser privileges as application-owned JavaScript. It can inspect rendered transcript and profile data, modify the page, issue same-origin requests, and transmit information to external services. Although loading Tailwind from its official CDN is not evidence that the dependency is currently malicious, this design makes the effective code executed by the Skill mutable after audit. A CDN compromise, upstream account compromise, DNS/TLS failure, or unexpected upstream change could affect all application pages without a local code change. The remote dependency is unnecessary for core transcript analysis and exceeds the minimum network access needed for the declared functionality. Tailwind can be compiled into a static CSS file and served locally. ### Attack Path 1. The CDN asset or its publishing account is compromised, or the unversioned resource is modified upstream. 2. A user opens any Communication DNA web page. 3. The browser downloads the current remote script because no local immutable artifact or integrity hash is enforced. 4. The script executes under the Communication DNA origin. 5. The modified script reads rendered sensitive information or invokes same-origin APIs. 6. The script can send collected data to an external endpoint from the user's browser. ### Impact Assessment A successful supply-chain compromise could affect every UI user and every application page. The r ...[truncated 572 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (30)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill processes highly sensitive transcript data, extracts speaker profiles and commitments, and links results into Personal CRM and Knowledge Base systems, but it provides no privacy warning, consent guidance, retention limits, or disclosure about cross-system propagation. In this context, the omission is especially dangerous because meeting transcripts often contain personal, confidential, or regulated information, and profiling plus database linking can amplify privacy harm well beyond the original transcription.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/templates/dashboard.html (reported line 7)May include surrounding context.

html

{% block content %}
<h2 class="text-2xl font-bold mb-6">Dashboard</h2>

<!-- Stats Cards -->
<div class="grid grid-cols-2 md:grid-cols-4 gap-4 mb-8">
    <div class="stat-card">
        <div class="text-3xl font-bold text-blue-400">{{ stats.transcriptions }}</div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/templates/speaker.html (reported line 5)May include surrounding context.

html

{% set active = "speakers" %}
{% block title %}{{ p.name }} — Communication DNA{% endblock %}
{% block content %}
<!-- Header -->
<div class="mb-6">
    <h2 class="text-2xl font-bold">{{ p.name }}</h2>
    <div class="flex flex-wrap gap-1 mt-2">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/templates/transcription.html (reported line 20)May include surrounding context.

html

</div>
</div>

<!-- Sentiment Arc -->
{% if arc %}
<div class="card mb-6">
    <h3 class="text-lg font-semibold mb-3">Sentiment Arc</h3>

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope or permission boundaries, yet it instructs the agent to read local files and interact with adjacent databases and transcript inputs. Without declared restrictions, an agent may over-read workspace data or invoke this skill in contexts where users did not intend broad file access, increasing the chance of unauthorized data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description uses broad triggers such as 'use when asked to analyze transcripts' and 'understand someone's speaking patterns,' which can match many ordinary user requests. This raises the risk of over-invocation on sensitive conversations or personal data, especially because the skill performs ingestion, profiling, and cross-system linking rather than a narrowly scoped transformation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cache helpers create and populate an analysis_cache table, causing transcript-derived analytics to be stored persistently rather than only returned to the caller. Because this skill processes sensitive communication data, persistence expands the privacy and retention surface: derived profiles may outlive the original user request, be accessed by other components, and accumulate without explicit consent or retention controls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

extract_commitments writes full transcript text and metadata for commitments, questions, and decisions into an extractions table, creating a new persistent dataset from potentially sensitive meeting content. This is dangerous because commitments and decisions often contain high-sensitivity business or personal information, and duplicating them increases exposure, discoverability, and retention beyond what a user may expect from simple transcript analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code persists transcript-derived text into the database with no visible user-facing disclosure or consent mechanism in the implementation. In a communication-profiling skill, extracted questions, decisions, and commitments can contain sensitive internal or personal content, so undisclosed storage creates a privacy and data-governance vulnerability even without classic code-execution risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

topic_detection persists inferred topics into the extractions table instead of only producing transient output. Even though topics are derived rather than raw text, they can reveal sensitive themes such as health, legal, HR, or strategic matters, and storing them creates an additional profile layer that may be queried or correlated later without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code stores derived topic labels in the database without any visible disclosure in this file that users are being profiled and that inferred attributes are retained. For this skill context, inferred communication topics are especially sensitive because they can summarize confidential meetings and enable long-term profiling across transcripts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill saves user-supplied files into a local uploads directory, which is a file-write operation affecting user data and system state. In this file there is no confirmation prompt, print/log disclosure, or explanatory comment/docstring near the write to make that behavior visible to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The API endpoint persists an uploaded file to the uploads directory before processing it, which is a safety-relevant file write. This code path contains no user-visible disclosure, confirmation, or explanatory comment indicating that the upload is stored locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CRM/KB linking and cross-search endpoints expose cross-system operations without any visible authentication, authorization, or rate/scope controls in this file. Because this skill handles potentially sensitive transcript and speaker data, broad unauthenticated integration actions can enable unauthorized data discovery, correlation, and expansion beyond the core analysis purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill exposes a POST endpoint that can push transcript-derived data to an external knowledge base, which is a write-capable cross-system action not clearly constrained by authentication, authorization, confirmation, or scope checks in this file. In a transcript-analysis tool, silently enabling outbound publication increases the risk of sensitive meeting content being exfiltrated or persisted in another system without explicit user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The knowledge-base push endpoint performs an external transmission/write operation with no visible confirmation, approval step, or safeguard in this file. Given that meeting transcripts often contain confidential business and personal information, one-click or API-triggered export materially raises the risk of unintended disclosure and irreversible propagation into downstream systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CRM linking command automatically matches speakers to CRM contacts without any visible confirmation or notice, potentially correlating transcript-derived identities with external personal records. In the context of meeting and speech analysis, this can create sensitive identity linkage and privacy harms even if the matching is only partially automated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The push-to-kb command causes transcript content to be published to an external Knowledge Base, which is a data-transfer side effect beyond local analysis. In a tool that processes sensitive meeting transcripts, this creates a real risk of unintended disclosure if a user invokes the command without clear disclosure, scoping, or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This command performs external data transmission to the Knowledge Base without visible disclosure at the CLI layer about the sensitivity and destination of the data. Because transcripts may contain confidential meeting content, commitments, and sentiment signals, silent or under-signaled publication materially increases the chance of confidentiality breaches.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The ingestion pipeline persists full raw transcript text, speaker names, and derived speaker linkage directly into the database without any visible minimization, consent check, retention control, or sensitivity gating. In this skill's context, transcripts and meeting recordings commonly contain highly sensitive personal, business, and potentially regulated data, so storing the complete raw content increases privacy and data-exposure risk if the database is later accessed by unauthorized users or reused outside the original purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CRM auto-linking logic persistently creates inferred relationships between speakers and CRM contacts based on fuzzy name matching alone, without user confirmation or notice. In this skill context, transcripts often contain sensitive personal and business discussions, so silent identity correlation can misattribute speech to the wrong person and disclose CRM profile data to downstream features.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The Knowledge Base auto-linking function writes inferred links from transcript topics to KB entities and associates them to speakers without consent or validation. Because topic extraction can be noisy, this can create inaccurate person-entity relationships that expose sensitive associations across systems and affect later retrieval or profiling features.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The function copies full transcription content and derived entities into a separate Knowledge Base database, expanding the data’s scope beyond simple analysis into persistent cross-system storage. In a transcript-analysis skill, this can expose sensitive meeting content, names, and commitments to another subsystem without any visible consent, policy gate, or minimization control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The push_to_kb function exports raw transcription text, summaries, metadata, and extracted entities into another database without any explicit permission check, warning, or redaction step. For a communication-profiling skill, meeting transcripts may contain confidential business plans, PII, health details, or commitments, so silent replication into a broader knowledge system materially increases exposure and retention risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The template renders CRM-derived personal data including name, email, company, role, health score, last interaction details, interaction counts, and last seen information directly into the speaker profile UI without any visible privacy notice, minimization, or indication of access controls. In this skill context, the feature explicitly correlates transcript-derived speaker profiles with CRM records, which increases sensitivity because it aggregates behavioral analysis with business-contact metadata and can expose more personal or confidential context than a user may expect.

Content

No source excerpt is available for this finding.