Security audit
Security checks for vulnerabilities and agentic risk
This is a small Roam API helper that clearly discloses transcript access, messaging, and its required API token, with no hidden code or persistence.
Install this only if you want Codex to use your Roam API token to read meeting transcripts, summaries, group lists, chat history, and post messages. Use a least-privileged Roam token if available, and review any drafted chat message before allowing it to be sent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Auth
`ROAM_API_KEY` env var (Personal Access Token from Roam Settings → Developer).
All requests: `Authorization: Bearer $ROAM_API_KEY`
The activation text is broad enough to trigger on generic requests about meetings, transcripts, call notes, or sending messages, which can cause the skill to be invoked without clear user intent for this specific integration. Because the skill can access sensitive meeting data and perform outbound messaging actions, overbroad routing increases the chance of unintended data access or side effects.
The description does not warn users that the skill can read meeting transcripts and send messages through the API, which are privacy-sensitive and action-taking capabilities. Without that notice, users may invoke the skill without understanding that it can expose confidential meeting content or post messages on their behalf.
No suspicious patterns detected.