Timeless.day Meeting Notes
Security checks across malware telemetry and agentic risk
Overview
The skill is coherent for Timeless meeting workflows, but it needs a Timeless account token and can access or upload sensitive meeting media.
Install this only if you are comfortable giving the agent access to your Timeless meetings, transcripts, recordings, and upload workflows. Keep the access token private, confirm uploads or room changes before they happen, and install yt-dlp only from a trusted source.
VirusTotal
66/66 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can use the token to access Timeless meetings, rooms, transcripts, AI documents, and recording URLs that the account can access.
The skill requires a Timeless account token for all API calls, which is expected but grants delegated access to the user's Timeless account data.
`TIMELESS_ACCESS_TOKEN` env var ... Authorization: Token $TIMELESS_ACCESS_TOKEN
Only install if you want the agent to have this Timeless account access; store the token securely and revoke or rotate it if no longer needed.
A user-selected recording may be uploaded to Timeless for transcription and AI processing.
The upload helper sends a selected local audio/video file to a presigned remote URL and then triggers Timeless processing; this is central to the skill but can move sensitive local media into the service.
curl -s -X PUT "$URL" -H "Content-Type: $MIME" --upload-file "$FILE"
Confirm the exact file, title, and language before uploading, and avoid uploading recordings that should not be stored or processed by Timeless.
API behavior or access may change unexpectedly, and failures could occur if Timeless changes these internal endpoints.
The skill intentionally relies on unofficial/internal Timeless API endpoints, which is disclosed but affects provenance and reliability.
This documents Timeless's internal API endpoints that can be used for programmatic access before the official public API launches. These endpoints may change without notice.
Use with awareness that this is an unofficial API integration and verify important actions or outputs if the service changes.
Questions and meeting context may be processed by Timeless's AI features as part of the workflow.
The artifacts describe interacting with Timeless's AI chat agent over meeting content, which is expected but involves an external agent/service boundary.
`threads[]`: AI chat threads. Use `threads[0].uuid` if you want to chat with the space agent.
Avoid sending prompts or meeting content to the Timeless AI chat that should not be processed by that service.