The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of meeting transcripts and action items.
Ingestion points: The processTranscriptReady function in SKILL.md fetches transcript data (including speaker text and summary items) from the Fireflies GraphQL API.
Boundary markers: No explicit delimiters or instructions are provided to the agent to ignore potentially malicious content embedded within the transcript text.
Capability inventory: The skill uses fetch for API communication and includes logic to route extracted action items to downstream systems (createTasksFromActionItems).
Sanitization: No sanitization or validation of the transcript content is performed before processing or logging.
[SAFE]: The skill follows security best practices for webhook implementation by requiring HMAC-SHA256 signature verification and using crypto.timingSafeEqual to protect against timing attacks.
[SAFE]: Sensitive credentials such as the API key and webhook secret are managed through environment variables rather than being hardcoded, which is the recommended security practice.

fireflies-webhooks-events