plaud-recordings-to-google-drive-sync

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The workflow requires the agent to read and then include presigned/signed URLs (presigned_url, result_signed_url) verbatim when calling other tools (upload_file_from_storage, speech-to-text submit), which are secret tokens/URLs and thus require the LLM to handle/output secret values directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow ingests free text via the Speech-to-Text With Speakers step by passing the Plaud recording’s public/presigned audio URL for transcription (and potentially Plaud’s own transcript), which originates from outsider-authored spoken content.