Security audit
Security checks for vulnerabilities and agentic risk
This Zoho skill is purpose-aligned, but it needs review because it combines broad business-data authority, local long-lived secrets, destructive examples, and third-party meeting transcription without enough safeguards.
Review this skill before installing. Use least-privilege Zoho scopes, keep secrets in a managed secret store instead of a skill-directory .env, require explicit approval for writes/deletes and meeting downloads, and only run the summarizer when everyone is authorized for recordings to be sent to Gemini. The package should also include the missing CLI wrapper or clearly declare and verify that dependency.
scripts/standup-summarizer.sh:93Zoho OAuth Token Sent to an Unvalidated Recording URL
scripts/standup-summarizer.sh:9Predictable and Potentially Permissive Temporary Storage Exposes Meeting Data
scripts/standup-summarizer.sh:156Gemini API Key Exposed in Request URLs
scripts/standup-summarizer.sh:153Uploaded Meeting Audio Is Not Deleted from the Gemini File API
A command that prints the current access token is highly risky in an agent context because tokens can be exposed in terminal output, logs, chat transcripts, screenshots, or copied accidentally. Since the token enables authenticated API access, disclosure can immediately permit unauthorized reads or writes within the Zoho tenant until expiry.
zoho help # Show all commands
zoho token # Print current access token (auto-refreshes)
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Run this curl command (replace placeholders):
curl -X POST "https://accounts.zoho.com/oauth/v2/token" \
This line explains that the refresh token is a long-lived credential and that the access token auto-refreshes, which is accurate documentation rather than active credential theft. However, the context does normalize handling a high-value persistent credential without sufficient safeguards, which contributes to operational risk when combined with local .env storage and shell-based workflows.
}
Save the **refresh_token** — this is your long-lived credential. The access token expires in 1 hour, but the CLI auto-refreshes it using the refresh token.
### Step 4: Find Your Org IDs
The skill explicitly instructs users to configure a .env containing client credentials and a long-lived refresh token. In agent environments with shell/file access, colocating secrets in the skill directory materially increases the risk of unintended disclosure through logs, command output, workspace sharing, or other tools reading local files.
CRM/Projects Org ID:
# After setting up .env with client_id, client_secret, refresh_token:
zoho raw GET /crm/v7/org | jq '.org[0].id'
The .env setup centralizes multiple sensitive values, including client secret, refresh token, and organization identifiers, in a predictable local file. While org IDs alone are not secret, bundling them with reusable credentials makes compromise easier and increases the blast radius if the workspace is exposed.
**Meeting Org ID:**
Log into [Zoho Meeting](https://meeting.zoho.com) → Admin Settings → look for the Organization ID in the URL or settings page. It's different from the CRM org ID.
### Step 5: Configure .env
Create `.env` in the skill directory:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
TMP_DIR="/tmp/standup-$$"
# ── Load env ──────────────────────────────────────────────────────────
source "${ZOHO_SKILL_DIR}/.env"
GEMINI_API_KEY="${GEMINI_API_KEY:-}"
ZOHO_MEETING_ORG_ID="${ZOHO_MEETING_ORG_ID:-853106938}"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cleanup() { rm -rf "$TMP_DIR"; }
trap cleanup EXIT
# ── Get Zoho access token ────────────────────────────────────────────
get_token() {
"${ZOHO_SKILL_DIR}/bin/zoho" token
}
The README promotes automated downloading of meeting recordings and sending them into a transcription pipeline, but it does not warn about consent, recording policies, retention, or sharing sensitive meeting content with a third-party model provider. In a workplace context, this can expose confidential discussions or regulated personal data and may lead users to deploy the workflow in violation of internal policy or applicable privacy law.
The skill documents extensive shell-based capabilities but declares no explicit tool scope or permission boundaries. In an agent environment, that increases the chance the skill is invoked with broader execution authority than intended, enabling credential handling, API calls, downloads, and file operations without clear restrictions.
The trigger description is very broad and includes generic terms like projects, tasks, meetings, and recordings, which are common in ordinary conversations. That can cause accidental invocation of a powerful integration skill in contexts where the user did not intend Zoho access, increasing the risk of unnecessary data exposure or unintended actions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Run this curl command (replace placeholders):
curl -X POST "https://accounts.zoho.com/oauth/v2/token" \
The documentation includes a direct delete command for CRM records with no warning, safety notes, or confirmation guidance. In an agent-assisted workflow, that normalizes destructive behavior and can lead to irreversible record deletion from a production CRM through user error or prompt ambiguity.
The recording download and summarization pipeline processes potentially sensitive meeting audio, transcripts, and summaries, and explicitly suggests sending content to external AI services, but it provides no privacy, consent, retention, or access-control guidance. This creates a realistic path for confidential business discussions or personal data to be exported and retained outside Zoho without informed approval.
This markdown file documents endpoints for listing and downloading recordings, including transcript and summary download URLs, which can expose sensitive meeting content. Under the markdown-specific warning criterion, the description lacks any caution about privacy, consent, or careful handling of user data affected by these operations.
The skill description suggests Zoho interaction, but this script also downloads recordings, extracts audio locally, and performs full transcription. While not inherently malicious, that broadens capability into surveillance-style content processing and increases privacy risk, especially because full transcripts are produced and returned to the caller.
The script sends downloaded Zoho meeting audio and derived transcript content to Google's Gemini APIs, expanding data flow beyond Zoho into a third-party processor. This is dangerous because meeting recordings commonly contain sensitive business discussions, customer data, and credentials, and the transfer occurs automatically without any consent gate, data minimization, or processor-validation controls.
This request uploads extracted meeting audio to Google's File API, constituting direct external exfiltration of potentially sensitive meeting content. Because the transfer is automatic and the skill context is Zoho-focused, the behavior is more dangerous: users are less likely to expect raw recordings to leave the primary platform.
if [[ "$WAV_BYTES" -gt 20000000 ]]; then
# Large file: upload via File API first
echo " 📤 Large file — uploading to Gemini File API..."
UPLOAD_RESP=$(curl -s -X POST \
"https://generativelanguage.googleapis.com/upload/v1beta/files?key=${GEMINI_API_KEY}" \
-H "X-Goog-Upload-Command: start, upload, finalize" \
-H "X-Goog-Upload-Header-Content-Length: ${WAV_BYTES}" \
Meeting recordings are uploaded or embedded into requests sent to external Gemini endpoints without any explicit warning, confirmation, or approval flow. This creates a real confidentiality risk because users may reasonably expect a Zoho skill to keep meeting data within Zoho or at least warn before sharing audio with a third party.
The prompt explicitly instructs Gemini that the speakers are Egyptian and speak in Egyptian Arabic mixed with English technical terms, effectively imposing a locale/language assumption. This can violate language/locale policy when the skill does not give users a choice or document that this is a region-specific tool.
The script sends transcription requests containing meeting audio or file references to Gemini's generateContent API. This exposes sensitive communications to a third-party model service and may also place data into provider-side processing pipelines without user awareness.
GEMINI_BODY_FILE="${TMP_DIR}/gemini_body_${i}.json"
echo "$GEMINI_BODY" > "$GEMINI_BODY_FILE"
GEMINI_RESP=$(curl -s -X POST \
"https://generativelanguage.googleapis.com/v1beta/models/gemini-2.0-flash:generateContent?key=${GEMINI_API_KEY}" \
-H "Content-Type: application/json" \
-d "@${GEMINI_BODY_FILE}")
The fallback retry to a second Gemini model repeats third-party transmission of the same sensitive meeting content, increasing exposure surface and data-sharing events. Retrying against multiple models without consent or minimization amplifies confidentiality and compliance risk.
echo " 🔄 Retrying with gemini-2.5-flash..."
GEMINI_BODY_FILE="${TMP_DIR}/gemini_body_${i}.json"
echo "$GEMINI_BODY" > "$GEMINI_BODY_FILE"
GEMINI_RESP=$(curl -s -X POST \
"https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash:generateContent?key=${GEMINI_API_KEY}" \
-H "Content-Type: application/json" \
-d "@${GEMINI_BODY_FILE}")
The README explicitly highlights handling of an Arabic and English language mix, which introduces a language-specific behavior in the skill description. There is no indication here that language handling is user-configurable or opt-in, which may conflict with organizational language/locale choice expectations.
This markdown file documents irreversible deletion operations for projects and tasks, but provides no warning about data loss, confirmation expectations, or recovery limitations. Under the markdown-specific warning criterion, descriptions of behaviors that can affect user data should include a caution when destructive actions are exposed.
The script sources a .env file and reads GEMINI_API_KEY, which is sensitive credential material. There is no user-facing warning, confirmation, or descriptive comment indicating that the skill accesses local secrets, which can be relevant for safety review of code that handles credentials.
When no date is provided, the script computes the target date and time range in the Africa/Cairo timezone. This is a locale-specific assumption that may lead to unintended behavior for users in other regions and is not presented as an explicit user choice.
No suspicious patterns detected.