SanctifAI Trust

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.10

Overview

The skill is coherent for Proof-of-Human attestations, but it needs review because some documented flows expand third-party data and code trust beyond the strongest privacy claims.

Review this before installing or recommending it for sensitive workflows. Keep taskData and resultData opaque, avoid PII, credentials, regulated data, and confidential business details, and prefer locally computed commitments where possible. For the hosted script path, consider requiring a pinned version, SRI, CSP controls, or self-hosting before using it on privileged application pages.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:262

Finding

Raw Task and Result Payloads Are Disclosed to the Hosted Chat Bridge

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–15, 262–278, and 296–297
Vulnerability Type: Privacy boundary violation and unnecessary transmission of potentially sensitive data
Risk Level: Medium

Vulnerable Code

text

Raw task data never leaves the client — only
`0x`+SHA-256 commitments are sent.

text

1. POST {APP_BASE_URL}/api/v1/attestations
2. Human opens approve_url in Chrome (passkey)
3. Poll GET {APP_BASE_URL}/api/v1/attestations/{id}
   or GET {APP_BASE_URL}/api/v1/attestations/{id}/wait
4. status=completed → certificate_url (hosted on trust.sanctifai.com)

json

{
  "task_type": "GEN",
  "domain": "GEN",
  "task_subtype": "Chat approval",
  "requesting_agent": "Support bot",
  "taskData": { "summary": "opaque task payload" },
  "resultData": { "decision": "approved" }
}

text

Retain the exact `taskData` / `resultData` you posted (see Shared rules). The
bridge approve client uses the same `sha256Hex` helper as Embedded.

Technical Analysis

The global description states that raw task data never leaves the client and that only SHA-256 commitments are transmitted. However, the Chat bridge workflow directs an agent to POST the un-hashed taskData and resultData fields to the hosted service at https://bridge.trust.sanctifai.com.

Hashing these fields later in the bridge approval client does not prevent the hosted bridge from receiving the original values. This creates a material mismatch between the declared privacy model and the actual Chat bridge data flow. Although the Skill separately advises users not to include personally identifiable information, an application or agent may rely on the stronger claim that raw data remains local and submit confidential business content.

Transmitting raw values also exceeds the minimum data access required for a commitment-based attestation when the commitments can be calculated locally ...[truncated 1349 chars]

Remediation

View remediation

Remediation Suggestions

1. Calculate SHA-256 commitments locally and send only task_commitment and result_commitment to the hosted bridge.
2. Redesign the bridge API so that possession of raw task and result payloads is not required for attestation creation.
3. If raw transmission is unavoidable, restrict the “raw task data never leaves the client” claim to the surfaces for which it is accurate.
4. Display a prominent disclosure and obtain explicit user approval before sending raw payloads to the bridge.
5. Add client-side validation that rejects likely secrets, credentials, personal data, and other prohibited content.
6. Document the bridge's data retention, logging, encryption, deletion, and access-control policies.
7. Add automated tests verifying that privacy-preserving modes transmit only fixed-length commitments and never serialize raw task or result objects.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:237

Finding

Unpinned Hosted JavaScript Executes with the Embedding Page's Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 237
Vulnerability Type: Mutable remote payload retrieval and execution
Risk Level: Medium

Vulnerable Code

html

<script src="https://trust.sanctifai.com/sanctifai-presence.js"></script>

Technical Analysis

The Extension integration instructs customers to load and execute JavaScript directly from a remote URL. The resource is not pinned to an immutable version and no Subresource Integrity hash is specified. Consequently, the effective code executed by an integrating application can change after the Skill has been reviewed.

A script loaded this way executes in the security context of the embedding page rather than in an isolated third-party origin. Compromise of the hosting service, deployment pipeline, DNS or distribution account—or an unauthorized modification by the provider—could therefore turn the documented integration into a remote code execution channel within customer web pages.

The URL belongs to the declared product domain, and the audited file contains no evidence that its current payload is malicious. The vulnerability is the absence of controls that constrain future changes to the remotely retrieved code.

Attack Path

1. An application follows the Skill and embeds the hosted script.
2. An attacker compromises the script host, deployment credentials, or another component capable of modifying sanctifai-presence.js.
3. The attacker replaces or modifies the hosted script with malicious JavaScript.
4. A user visits the integrating application and the browser downloads the modified resource.
5. The browser executes the payload under the integrating page's origin and JavaScript privileges.
6. The payload can inspect accessible page content, intercept attestation inputs and results, alter requests, or send data to an attacker-controlled endpoint.

Impact Assessment

A modified script could exercise the same browser-side p ...[truncated 634 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish the integration script under immutable, version-specific URLs.
2. Pin integrations to a reviewed release rather than a mutable unversioned asset.
3. Publish a cryptographic Subresource Integrity hash and require integrity with an appropriate crossorigin attribute.
4. Use a restrictive Content Security Policy that permits scripts only from explicitly approved sources and minimizes outbound connection destinations.
5. Provide signed release artifacts or a self-hosting option so customers can review and control upgrades.
6. Establish deployment signing, protected release credentials, change review, monitoring, and rapid revocation procedures for hosted assets.
7. Consider isolating third-party functionality in a sandboxed iframe with narrowly scoped message passing where practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

export async function POST(req) {
  const body = await req.json();
  const userId = await getEmployeeIdFromSession(req); // from YOUR session, not the body
  const r = await fetch('https://trust.sanctifai.com/api/presence/start', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${process.env.TRUST_API_KEY}` },
    body: JSON.stringify({

Static analysis

No suspicious patterns detected.