zoho
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches meeting recordings (MP4 files) from Zoho's official domains (
meeting.zoho.comandzohopublic.com) for the purpose of transcription and summarization. - [DATA_EXFILTRATION]: Transmits extracted audio data to Google's Gemini API (
generativelanguage.googleapis.com) to perform transcription. This is the primary function of the included standup summarizer script and uses a well-known service. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from Zoho CRM and Meeting recordings which could potentially contain untrusted instructions.
- Ingestion points: Zoho API responses and transcribed meeting audio processed via
scripts/standup-summarizer.sh. - Boundary markers: None detected in the script output for the agent.
- Capability inventory: Performs network requests via
curl, file system writes to/tmpand/root/clawd/data/, and executesffmpegfor media processing. - Sanitization: The script does not sanitize the transcribed text for potential prompt injection patterns before outputting it.
Audit Metadata