fireflies-transcript

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill uses curl and jq to interact with a legitimate, well-known API (api.fireflies.ai). It correctly handles sensitive API keys through local environment files and explicitly warns against committing or printing the key, aligning with security best practices for secret management.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes meeting transcripts which are externally controlled content.
  • Ingestion points: Meeting text is fetched via GraphQL query in SKILL.md.
  • Boundary markers: Absent; transcript sentences are extracted and printed as raw text.
  • Capability inventory: Command line tool usage (curl, jq, date) across all retrieval steps.
  • Sanitization: Data is processed via jq to extract specific JSON fields, which mitigates shell-level injection risks when formatting output.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 11:52 AM