Security audit
Security checks across malware telemetry and agentic risk
This Zoho skill is purpose-aligned, but it needs Review because it can change business data, use long-lived Zoho access, and send meeting recordings to Google Gemini without strong consent or safety controls.
Install only if you trust the publisher and can review or obtain the missing zoho CLI wrapper. Use a dedicated least-privilege Zoho OAuth app, avoid unnecessary ALL scopes, protect the refresh token and Gemini key, require explicit confirmation for writes/deletes, and run meeting transcription only with organizational and participant approval for third-party Gemini processing.
if [[ "$WAV_BYTES" -gt 20000000 ]]; then
# Large file: upload via File API first
echo " 📤 Large file — uploading to Gemini File API..."
UPLOAD_RESP=$(curl -s -X POST \
"https://generativelanguage.googleapis.com/upload/v1beta/files?key=${GEMINI_API_KEY}" \
-H "X-Goog-Upload-Command: start, upload, finalize" \
-H "X-Goog-Upload-Header-Content-Length: ${WAV_BYTES}" \GEMINI_BODY_FILE="${TMP_DIR}/gemini_body_${i}.json"
echo "$GEMINI_BODY" > "$GEMINI_BODY_FILE"
GEMINI_RESP=$(curl -s -X POST \
"https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${GEMINI_API_KEY}" \
-H "Content-Type: application/json" \
-d "@${GEMINI_BODY_FILE}")echo " 🔄 Retrying with gemini-2.5-flash..."
GEMINI_BODY_FILE="${TMP_DIR}/gemini_body_${i}.json"
echo "$GEMINI_BODY" > "$GEMINI_BODY_FILE"
GEMINI_RESP=$(curl -s -X POST \
"https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${GEMINI_API_KEY}" \
-H "Content-Type: application/json" \
-d "@${GEMINI_BODY_FILE}")66/66 vendors flagged this skill as clean.
No suspicious patterns detected.