twinmind-migration-deep-dive

Pass

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill accesses the local file system using fs.readdirSync and fs.readFileSync within the assessMigration function in references/implementation.md. This is used to read meeting transcripts from a user-specified directory for migration purposes.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to external APIs including api.twinmind.com, api.fireflies.ai, and api.rev.ai to export and import meeting data. These are official endpoints for the services the skill integrates with.
  • [PROMPT_INJECTION]: There is a potential surface for indirect prompt injection as the skill ingests data from external APIs and local files (transcripts) which are then processed by the agent.
  • Ingestion points: Local files via dataPath in references/implementation.md; External APIs api.fireflies.ai and api.rev.ai.
  • Capability inventory: File system read access (fs.readFileSync), network access (fetch, curl).
  • Boundary markers: None identified in the provided implementation code.
  • Sanitization: The skill uses standard parsing logic (e.g., JSON.parse and VTT parsing) but does not specifically sanitize transcript content for adversarial prompt instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 4, 2026, 07:30 PM