zoho

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches meeting recordings (MP4 files) from Zoho's official domains (meeting.zoho.com and zohopublic.com) for the purpose of transcription and summarization.
  • [DATA_EXFILTRATION]: Transmits extracted audio data to Google's Gemini API (generativelanguage.googleapis.com) to perform transcription. This is the primary function of the included standup summarizer script and uses a well-known service.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Zoho CRM and Meeting recordings which could potentially contain untrusted instructions.
  • Ingestion points: Zoho API responses and transcribed meeting audio processed via scripts/standup-summarizer.sh.
  • Boundary markers: None detected in the script output for the agent.
  • Capability inventory: Performs network requests via curl, file system writes to /tmp and /root/clawd/data/, and executes ffmpeg for media processing.
  • Sanitization: The script does not sanitize the transcribed text for potential prompt injection patterns before outputting it.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 04:46 AM
Security Audit — agent-trust-hub — zoho