Security audit

Communication DNA

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does the advertised transcript analysis, but it handles sensitive meeting, CRM, and knowledge-base data with broad unauthenticated integration actions and persistent copying across local systems.

Review before installing. Use only in a trusted local workspace, do not expose the Flask server on a shared or public network, and use CRM/Knowledge Base integrations only if you trust those sibling projects and are comfortable with meeting transcripts and derived speaker data being linked, searched, and copied into persistent databases. For sensitive meetings, add authentication, explicit export confirmation, scoping, and deletion/retention controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares no explicit permissions, yet its documented behavior clearly includes reading local files and adjacent databases (`crm.db`, `knowledge.db`) as part of ingestion and integrations. This creates an authorization and transparency gap: users or orchestrators may invoke the skill without realizing it can access sensitive transcript files and cross-system data sources.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior materially exceeds the core description by adding persistent storage, full-text search, CRM linking, KB cross-search, and pushing full transcripts into external systems. For a skill handling meeting transcripts and speech profiles, these undeclared capabilities increase the chance of silent data propagation, profiling, and retention of highly sensitive communications beyond what a user may expect.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module header states the functions operate on existing DB segments and return structured results, but several analysis paths also persist derived artifacts such as cache entries and extracted commitments/topics back into the database. In a transcript-analysis skill, this creates an integrity and privacy risk because merely invoking read-style analytics can silently mutate stored state and retain additional sensitive inferences beyond the original transcript.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation implies read/compute-only behavior, but the implementation writes to analysis_cache and extractions tables. This mismatch is security-relevant because callers, reviewers, or higher-level orchestration may treat the module as non-mutating and therefore fail to apply authorization, consent, auditing, or data-retention controls appropriate for persistent writes of sensitive transcript inferences.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The invocation text uses broad trigger phrases such as analyzing transcripts, understanding speaking patterns, or finding commitments in meetings, which can match many common user requests. That increases the risk of overbroad or unintended activation on sensitive conversational content, especially because the skill performs storage, profiling, and external linking once invoked.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill processes highly sensitive communication data and builds speaker profiles, extracts commitments, and can propagate transcripts and derived entities into CRM and knowledge-base systems, yet the description lacks any warning about profiling, retention, or sharing. In this context, omission of such notice is dangerous because users may submit private meetings without understanding that personal behavioral inferences and full transcript data may be persisted and exported.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: extract_commitments stores raw transcript text for detected commitments, questions, and decisions into the extractions table without any visible consent, minimization, or disclosure mechanism. Because meeting transcripts often contain sensitive personal, business, or legal content, duplicating and classifying this text increases privacy exposure, expands the attack surface for later access, and may create unexpected records of promises or decisions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: topic_detection persists inferred topics to the database, which can reveal sensitive attributes or summarize confidential discussions even when the original transcript is not directly exposed. In this skill context, topic inference is especially privacy-sensitive because it transforms conversation data into compact, searchable intelligence that may be easier to misuse or repurpose than the raw transcript itself.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The push-to-kb command sends transcription content to an external or separate knowledge-base integration with no explicit user-facing disclosure, confirmation, or scope preview. Because this skill handles meeting transcripts and speech analysis data that may contain sensitive personal, business, or confidential information, silent export materially increases privacy and data-leakage risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The link-crm command performs automatic matching between local speaker records and CRM contacts without warning the user that personal identity data is being processed across systems. In this skill's context, speaker identities are derived from transcripts, so correlating them with CRM data can expose sensitive relationship and identity information and may violate user expectations or internal privacy controls.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The cross-search command may send the user's query text into integrated sources, including the KB, without telling the user that search terms may leave the local DNA context. While the impact is lower than full transcript export, search queries can still contain sensitive names, projects, or investigative terms and may create unintended disclosure to another system.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The push_to_kb function exports full transcription text and extracted entities into another database without any consent check, policy gate, scope restriction, or disclosure mechanism. In a communication-profiling skill that processes meetings and speech transcripts, this increases privacy and data-governance risk because sensitive meeting content may be replicated into a broader knowledge system and become discoverable through cross_search.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The cross-search UI inserts multiple server-controlled fields (`link`, `label`, `text`, and CSS-dependent values) directly into `innerHTML` when rendering search results. If any transcript, KB entry, speaker name, title, text snippet, or URL contains attacker-controlled HTML or a `javascript:`/malicious URL, this can lead to DOM-based XSS and phishing/open-redirect style abuse in a page that aggregates sensitive CRM/KB/transcript data.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The template renders CRM contact data including name, email, company, role, health score, last interaction details, and interaction counts directly into the speaker page. In a communication-analysis skill that aggregates transcript data with CRM context, this creates a real privacy and data-exposure risk if the page is accessible to users who are not explicitly authorized to view CRM-enriched personal data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal