fireflies-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes environment variables (
FIREFLIES_API_KEY) for authentication, which is the recommended method for handling secrets and prevents hardcoded credential exposure. - [SAFE]: All network requests are directed to the official Fireflies.ai API domain (
api.fireflies.ai), an established and well-known service provider. - [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes data from an external source (meeting transcripts and summaries) that could potentially contain malicious instructions targeting the AI agent.
- Ingestion points: Meeting titles, transcript text, summaries, and action items retrieved via the GraphQL API in Steps 2, 3, and 4.
- Boundary markers: None; the data is logged directly to the console without delimiters or instructions for the agent to ignore embedded commands.
- Capability inventory: The skill operates in an environment with
Bash(curl:*),Read,Write, andEditpermissions, which could be leveraged if the agent follows instructions found in meeting data. - Sanitization: The examples do not demonstrate validation or filtering of the API response content before display or processing.
Audit Metadata