timeless-api
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands for its core functionality, specifically involving tool execution.
- Uses
curlto interact with themy.timeless.dayAPI endpoints. - Utilizes
yt-dlpfor downloading and processing YouTube video content. - Orchestrates local shell scripts (
upload.sh,podcast.sh,youtube.sh) to handle media workflows. - [EXTERNAL_DOWNLOADS]: The skill fetches data and media files from remote infrastructure.
- Connects to
https://my.timeless.dayfor all service operations. - Downloads meeting recordings from signed Google Cloud Storage URLs (
storage.googleapis.com). - Retrieves media content from third-party podcast feeds and YouTube platforms.
- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection due to the nature of its data processing.
- Ingestion points: Processes meeting transcripts, AI summaries, and external media metadata from the Timeless API and external video/audio platforms into the agent context (SKILL.md).
- Boundary markers: Absent. There are no explicit instructions or delimiters used to separate untrusted external content from the agent's core instructions.
- Capability inventory: The skill possesses capabilities for network operations (
curl), file system writes (/tmp,timeless-processed.json), and external media fetching (yt-dlp) across its associated scripts. - Sanitization: No evidence of input validation or sanitization is provided for the external data being ingested.
Audit Metadata