n8n:loom-transcript
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
bashandcurlto interact with Loom's GraphQL API and download transcript files. These commands are used for legitimate data retrieval from a well-known service. - [EXTERNAL_DOWNLOADS]: The skill fetches video metadata and transcript content (VTT and JSON files) from Loom's official domains (
loom.com). This is consistent with the skill's stated purpose of fetching transcripts. - [PROMPT_INJECTION]: The skill processes untrusted data from an external source (the transcript content from Loom). While this presents a surface for indirect prompt injection if a video's transcript contains malicious instructions, the skill is focused on presentation, and the risk is considered low. The skill also includes a validation step requiring the extraction of a 32-character hex video ID from the user-provided URL, which helps prevent basic command injection via the URL argument.
Audit Metadata