Meeting Transcripts

Capture meeting transcripts from Fireflies.ai via polling or webhooks. Auto-fetches transcripts, extracts action items/decisions/summaries, and writes struct...

Security Scan

The skill's code and instructions match its stated purpose (pulling transcripts from Fireflies and saving them to local memory), but the registry metadata omits the credential requirement and the webhook guidance (exposing a local server) has security implications the user should consider.

Purpose & Capability

The scripts clearly implement Fireflies.ai transcript polling, fetching, and webhook handling and only call the Fireflies GraphQL API; however the registry metadata lists no required credentials while the code expects a Fireflies API key file (~/.openclaw/secrets/fireflies-api-key.txt) and an optional webhook secret. That mismatch is an oversight and should be corrected.

Instruction Scope

SKILL.md and the scripts are narrowly scoped to: read a local API key/secret, poll or receive webhooks from Fireflies, fetch transcripts, and write markdown files to a memory directory. The instructions do recommend exposing a local webhook receiver via Cloudflare Tunnel/ngrok — a normal requirement for receiving webhooks but a non-trivial operational/security step that could expose the service to the public if misconfigured.

Install Mechanism

This is an instruction-only skill with no install spec; it relies on Node 18+ and the included scripts. No external downloads or archive extracts are performed by the skill.

Credentials

The code only needs a Fireflies API key and an optional webhook secret (stored as files in ~/.openclaw/secrets). Those are proportionate to the stated function, but the registry declares no primary credential or required env vars — the omission is inconsistent and could mislead users during install/permission review.

Persistence & Privilege

The skill does not request permanent/autonomic platform-level privileges (always: false). It writes state and output to the user's home workspace (memory/meetings and a .poll-state.json file), which is expected for a polling/webhook capture skill and is limited to its own paths.

Assessment

This skill appears to do what it says: it reads a Fireflies API key (stored in ~/.openclaw/secrets/fireflies-api-key.txt), polls or accepts webhooks from Fireflies, and writes meeting markdown files to your workspace. Before installing: (1) Be aware the registry metadata does not list the required API key — you must create and store it as the README instructs. (2) The webhook mode requires exposing a local HTTP endpoint (ngrok/Cloudflare Tunnel); only do that if you understand the risks and have protected the endpoint with the optional webhook secret. (3) Store the API key/secret with restrictive file permissions and prefer the webhook secret so the server verifies signatures. (4) Inspect logs/output locations (~/clawd or OPENCLAW_WORKSPACE) for sensitive transcript content and consider access controls for that directory. If you'd like, I can suggest a safer webhook deployment pattern (e.g., host the receiver in a secured cloud function or use a vetted tunneling setup) or generate exact commands to set file permissions and configure the webhook secret.

Meeting Transcripts (Fireflies.ai)

Auto-capture meeting transcripts from Fireflies.ai, extract action items and decisions, write structured markdown to memory.

Setup

1. Store API key

echo "YOUR_FIREFLIES_API_KEY" > ~/.openclaw/secrets/fireflies-api-key.txt

Get your key from Fireflies dashboard → Settings → Developer Settings.

2. Poll for new transcripts (recommended)

node scripts/poll-new-meetings.js

Schedule via OpenClaw cron every 30 minutes. Tracks processed meetings to avoid duplicates.

3. Real-time webhooks (optional)

node scripts/webhook-server.js

Runs on port 3142. Expose via Cloudflare Tunnel or ngrok, then paste the URL into Fireflies Settings → Developer Settings → Webhook URL.

Optional webhook secret:

echo "YOUR_SECRET" > ~/.openclaw/secrets/fireflies-webhook-secret.txt

4. Fetch a specific transcript

node scripts/fetch-transcript.js <meetingId>

Output

Transcripts are saved to memory/meetings/YYYY-MM-DD-<title>.md with:

• Title, date, duration, participants
• AI summary from Fireflies
• Action items (as checkboxes)
• Key topics and keywords
• Full transcript with speaker labels and timestamps

Cron Setup

Schedule polling every 30 minutes:

Check Fireflies for new meeting transcripts. Run: node <skill-path>/scripts/poll-new-meetings.js — if new meetings found, briefly notify the user with the meeting title(s). If no new meetings, do nothing (NO_REPLY).

Requirements

• Fireflies.ai Pro account ($10/mo) — includes API access
• Node.js 18+