skills/jeremylongshore/tons-of-skills-marketplace/podium-call-transcript-pipeline/Gen Agent Trust Hub
podium-call-transcript-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill architecture is designed to ingest and process data from external Podium webhooks, which represents a standard vulnerability surface for indirect prompt injection.
- Ingestion points: The FastAPI handler in
scripts/webhook_ingest.pyacts as the primary ingestion point, accepting JSON payloads from the Podium transcript service. - Boundary markers: Security boundaries are enforced via HMAC signature verification, delegating to the
podium-webhook-reliabilityskill to ensure the authenticity of incoming requests. - Capability inventory: The skill utilizes local file system writes for durable inbox storage (SQLite) and audit logs, and it performs authenticated network requests to the Podium API for fallback transcript polling.
- Sanitization: The pipeline includes a dedicated PII redaction layer (
scripts/pii_redact.py) that uses both regular expressions and Named Entity Recognition (NER) to mask sensitive information such as credit card numbers, phone numbers, and names before the data reaches downstream RAG or LLM systems.
Audit Metadata