Fireflies
ReviewAudited by ClawScan on May 1, 2026.
Overview
This skill coherently provides Fireflies.ai read/query examples, but users should notice that it uses a Fireflies API key to access potentially sensitive meeting transcripts, contacts, and analytics.
This appears to be a straightforward Fireflies.ai API helper. Before installing, confirm you are comfortable giving the agent a Fireflies API key and potentially exposing meeting transcripts, attendee emails, contacts, summaries, and analytics in the chat. Use narrow prompts, date ranges, and transcript IDs to limit what is retrieved.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could retrieve Fireflies data such as meeting transcripts, participant emails, summaries, contacts, active meetings, and analytics using the configured API key.
The skill requires a Fireflies API key and uses it as a bearer token to access Fireflies account data. This is expected for the stated integration, but it grants access to meeting records available to that key.
Authorization header: `Bearer $FIREFLIES_API_KEY`
Use an API key with the least access available, revoke it if no longer needed, and ask the agent to confirm before querying highly sensitive meetings.
If invoked too broadly, the agent may pull more meeting data than the user intended into the conversation.
The skill documents raw curl-based GraphQL API calls. This is central to the skill's purpose and the shown examples are read-oriented, but the user should keep query scope intentional.
curl -s -X POST https://api.fireflies.ai/graphql \
Specify transcript IDs, date ranges, participants, and limits when asking the agent to use this skill.
A user may not see all setup requirements from the registry summary alone.
The included skill.json declares required local tools and a required credential, while the registry summary reports no required binaries or primary credential. This appears to be an under-declared metadata issue rather than hidden behavior.
"requires": { "binaries": ["curl", "jq"] }, "credentials": { "primary": { "name": "FIREFLIES_API_KEY"Review the skill.json and SKILL.md setup instructions before installing, and ensure curl, jq, and the Fireflies API key are intentionally configured.