fireflies-transcript
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses
curlandjqto interact with a legitimate, well-known API (api.fireflies.ai). It correctly handles sensitive API keys through local environment files and explicitly warns against committing or printing the key, aligning with security best practices for secret management. - [INDIRECT_PROMPT_INJECTION]: The skill processes meeting transcripts which are externally controlled content.
- Ingestion points: Meeting text is fetched via GraphQL query in SKILL.md.
- Boundary markers: Absent; transcript sentences are extracted and printed as raw text.
- Capability inventory: Command line tool usage (curl, jq, date) across all retrieval steps.
- Sanitization: Data is processed via
jqto extract specific JSON fields, which mitigates shell-level injection risks when formatting output.
Audit Metadata