Skills join-meeting
📦
join-meeting
Content revision r1 Critical 🌐 Network access📁 Filesystem access🔑 Env variables⚡ Contains scripts⚙️ External commands
Join Meetings With an AI Agent
AI agents cannot attend live meetings without custom audio, video, and transcript plumbing. This skill connects them to Google Meet, Zoom, and Teams through AgentCall.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "join-meeting" from https://skillstore.io/skills/pattern-ai-labs-join-meeting.md and its manifest at https://skillstore.io/api/skills/pattern-ai-labs-join-meeting/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "join-meeting". Join this Google Meet as Juno and help answer product questions.
Expected outcome:
- The bot joins the meeting and waits for a participant.
- It introduces itself by voice, listens to transcript events, and answers when addressed.
- After the call ends, it provides a short summary and cleanup status.
Using "join-meeting". Join as a silent note taker and do not speak.
Expected outcome:
- The bot joins without speaking and collects transcript events.
- The final response lists decisions, open questions, owners, and action items.
Using "join-meeting". Join with screenshare and show the dashboard when I ask.
Expected outcome:
- The bot starts with voice and avatar only.
- When requested, it shares the prepared dashboard and narrates the key points.
Security Audit
Criticalv4 • 7/6/2026 Open versioned report
The skill intentionally connects a local AI agent to live meetings through AgentCall, including transcripts, voice, screenshots, screenshare, chat, and tunnels. Many static hits are false positives from Markdown fences or JavaScript template literals, but confirmed risks remain for credential handling, external transport, local filesystem access, screen capture, XSS-prone UI rendering, and transcript-driven agent control. It should not be auto-published without explicit consent flows, restricted permissions, and stronger data handling guidance.
54
Files scanned
17,801
Lines analyzed
605
Review items
0
False positives ignored
Confirmed security concerns (18)
Critical
Meeting Participants Can Steer a Full Agent Session
The skill states that meeting transcripts arrive as agent input and that any participant can steer the agent. The README also says the agent keeps full session context and can search code, edit files, run commands, and commit changes while in the meeting.
The files explicitly describe transcript-driven control and full agent capabilities. This creates a strong prompt-injection and authorization risk in meetings with untrusted participants.
High
Environment file access
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || "https://api.agentcall.dev";
The code at examples/notetaker-simple/notetaker.js:29 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || "";
The code at examples/notetaker-simple/notetaker.js:30 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || "https://api.agentcall.dev";
The code at examples/notetaker-smart/notetaker.js:34 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || "";
The code at examples/notetaker-smart/notetaker.js:35 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
// const genAI = new GoogleGenerativeAI(process.env.GOOGLE_API_KEY);
The code at examples/notetaker-smart/notetaker.js:143 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Screen capture upload
- **Screenshots** — capture what's on screen at any time
The feature at README.md:122 can capture meeting screens or frames and return them as media events. This is sensitive meeting data and requires explicit consent and access controls.
High
Screen capture upload
### Screenshots & Capture (all modes)
The feature at references/api.md:345 can capture meeting screens or frames and return them as media events. This is sensitive meeting data and requires explicit consent and access controls.
Show all 18 confirmed findings
High
Screen capture upload
In webpage modes (`webpage-audio`, `webpage-av`, `webpage-av-screenshare`), the bot's audio doesn't
The feature at references/guides/webpage-audio.md:3 can capture meeting screens or frames and return them as media events. This is sensitive meeting data and requires explicit consent and access controls.
High
Environment file access
this.apiKey = apiKey || process.env.AGENTCALL_API_KEY || cfg.api_key || '';
The code at scripts/node/agentcall.js:24 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
this.baseURL = baseURL || process.env.AGENTCALL_API_URL || cfg.api_url || 'https://api.agentcall.dev
The code at scripts/node/agentcall.js:25 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || 'https://api.agentcall.dev';
The code at scripts/node/bridge-visual.js:125 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || '';
The code at scripts/node/bridge-visual.js:126 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || 'https://api.agentcall.dev';
The code at scripts/node/bridge.js:50 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || '';
The code at scripts/node/bridge.js:51 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Environment file access
const apiKey = process.env.AGENTCALL_API_KEY;
The code at scripts/node/join.js:94 reads configuration values that can include AgentCall API keys. Secret-bearing config files require strong permissions and disclosure.
High
Sensitive Meeting Media Can Be Captured and Transferred
The skill supports transcripts, screenshots, screen capture, chat, audio, avatars, and screenshare. These features can expose confidential meeting content through AgentCall services and local output files.
The cited documentation explicitly lists talk, listen, screenshots, chat, and capture commands. The privacy risk follows directly from those supported capabilities.
High
Localhost Tunnel Can Expose Local Web Content
The skill lets the agent serve local webpages and share public tunnel URLs with meeting participants. If the wrong port or directory is selected, local services or generated files may become reachable through the tunnel.
The workflow and tunnel code show public URLs proxying requests to localhost ports. This is intended functionality but creates a clear exposure boundary.
Capability review items (605)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/coding-companion/bridge.py:103 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/coding-companion/bridge.py:45 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The location at examples/coding-companion/bridge.py:100 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at examples/coding-companion/bridge.py:102 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at examples/coding-companion/bridge.py:103 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
headers={"Authorization": f"Bearer {API_KEY}"}
The location at examples/coding-companion/bridge.py:201 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
uri = f"{ws_url}/v1/calls/{call_id}/ws?api_key={API_KEY}"
The location at examples/coding-companion/bridge.py:221 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
cp SKILL-FRAGMENT.md ~/.claude/skills/voice-meeting/SKILL.md
The code or instructions at examples/coding-companion/README.md:131 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
cp bridge.py ~/.claude/skills/voice-meeting/scripts/bridge.py
The code or instructions at examples/coding-companion/README.md:132 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Linux /proc filesystem access
echo '{"command": "tts.speak", "text": "Hello!"}' > /proc/<PID>/fd/0
The instructions at examples/coding-companion/README.md:152 write commands through /proc/<PID>/fd/0 into a running process. That process file-descriptor manipulation is powerful and easy to misuse.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/coding-companion/README.md:123 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
The key is read from `~/.agentcall/config.json` (persists across sessions) or
The code or instructions at examples/coding-companion/SKILL-FRAGMENT.md:35 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
mkdir -p ~/.agentcall && echo '{"api_key": "KEY_HERE"}' > ~/.agentcall/config.json
The code or instructions at examples/coding-companion/SKILL-FRAGMENT.md:39 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
`AGENTCALL_API_KEY` env var. If neither exists, ask the user for their key
The location at examples/coding-companion/SKILL-FRAGMENT.md:36 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
mkdir -p ~/.agentcall && echo '{"api_key": "KEY_HERE"}' > ~/.agentcall/config.json
The location at examples/coding-companion/SKILL-FRAGMENT.md:39 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/meeting-assistant-smart/assistant.py:60 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/meeting-assistant-smart/assistant.py:28 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The location at examples/meeting-assistant-smart/assistant.py:57 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at examples/meeting-assistant-smart/assistant.py:59 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at examples/meeting-assistant-smart/assistant.py:60 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
HEADERS = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}
The location at examples/meeting-assistant-smart/assistant.py:63 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# export ANTHROPIC_API_KEY="sk-ant-..."
The location at examples/meeting-assistant-smart/assistant.py:175 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# export OPENAI_API_KEY="sk-..."
The location at examples/meeting-assistant-smart/assistant.py:191 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# genai.configure(api_key=os.environ["GOOGLE_API_KEY"])
The location at examples/meeting-assistant-smart/assistant.py:209 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/meeting-assistant-smart/README.md:145 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export ANTHROPIC_API_KEY="sk-ant-..."
The location at examples/meeting-assistant-smart/README.md:146 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/meeting-assistant/assistant.py:48 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/meeting-assistant/assistant.py:15 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The location at examples/meeting-assistant/assistant.py:45 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at examples/meeting-assistant/assistant.py:47 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at examples/meeting-assistant/assistant.py:48 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
HEADERS = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}
The location at examples/meeting-assistant/assistant.py:51 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/meeting-assistant/README.md:33 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/notetaker-multilingual/notetaker.py:63 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-multilingual/notetaker.py:14 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export GOOGLE_API_KEY="your_gemini_api_key"
The location at examples/notetaker-multilingual/notetaker.py:15 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The location at examples/notetaker-multilingual/notetaker.py:59 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
GOOGLE_API_KEY = os.environ.get("GOOGLE_API_KEY", "")
The location at examples/notetaker-multilingual/notetaker.py:60 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at examples/notetaker-multilingual/notetaker.py:62 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at examples/notetaker-multilingual/notetaker.py:63 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not GOOGLE_API_KEY:
The location at examples/notetaker-multilingual/notetaker.py:66 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
print("Error: Set GOOGLE_API_KEY environment variable (Gemini API key)")
The location at examples/notetaker-multilingual/notetaker.py:67 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
HEADERS = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}
The location at examples/notetaker-multilingual/notetaker.py:70 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
genai.configure(api_key=GOOGLE_API_KEY)
The location at examples/notetaker-multilingual/notetaker.py:181 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-multilingual/README.md:29 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export GOOGLE_API_KEY="your_gemini_api_key"
The location at examples/notetaker-multilingual/README.md:30 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
console.error("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json");
The code or instructions at examples/notetaker-simple/notetaker.js:33 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
* export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-simple/notetaker.js:9 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || "";
The location at examples/notetaker-simple/notetaker.js:30 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if (!API_KEY) {
The location at examples/notetaker-simple/notetaker.js:32 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
console.error("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json");
The location at examples/notetaker-simple/notetaker.js:33 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
Authorization: `Bearer ${API_KEY}`,
The location at examples/notetaker-simple/notetaker.js:38 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/notetaker-simple/notetaker.py:39 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-simple/notetaker.py:9 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The location at examples/notetaker-simple/notetaker.py:36 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at examples/notetaker-simple/notetaker.py:38 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at examples/notetaker-simple/notetaker.py:39 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
HEADERS = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}
The location at examples/notetaker-simple/notetaker.py:42 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-simple/README.md:25 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-simple/README.md:33 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
console.error("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json");
The code or instructions at examples/notetaker-smart/notetaker.js:38 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
* export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-smart/notetaker.js:9 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || "";
The location at examples/notetaker-smart/notetaker.js:35 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if (!API_KEY) {
The location at examples/notetaker-smart/notetaker.js:37 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
console.error("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json");
The location at examples/notetaker-smart/notetaker.js:38 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
Authorization: `Bearer ${API_KEY}`,
The location at examples/notetaker-smart/notetaker.js:43 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
// export ANTHROPIC_API_KEY="sk-ant-..."
The location at examples/notetaker-smart/notetaker.js:111 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
// export OPENAI_API_KEY="sk-..."
The location at examples/notetaker-smart/notetaker.js:126 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
// export GOOGLE_API_KEY="..."
The location at examples/notetaker-smart/notetaker.js:140 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
// const genAI = new GoogleGenerativeAI(process.env.GOOGLE_API_KEY);
The location at examples/notetaker-smart/notetaker.js:143 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/notetaker-smart/notetaker.py:39 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-smart/notetaker.py:9 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The location at examples/notetaker-smart/notetaker.py:36 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at examples/notetaker-smart/notetaker.py:38 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at examples/notetaker-smart/notetaker.py:39 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
HEADERS = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}
The location at examples/notetaker-smart/notetaker.py:42 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# export ANTHROPIC_API_KEY="sk-ant-..."
The location at examples/notetaker-smart/notetaker.py:98 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# client = Anthropic() # reads ANTHROPIC_API_KEY from env
The location at examples/notetaker-smart/notetaker.py:102 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# export OPENAI_API_KEY="sk-..."
The location at examples/notetaker-smart/notetaker.py:114 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# client = OpenAI() # reads OPENAI_API_KEY from env
The location at examples/notetaker-smart/notetaker.py:118 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# export GOOGLE_API_KEY="..."
The location at examples/notetaker-smart/notetaker.py:129 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# genai.configure(api_key=os.environ["GOOGLE_API_KEY"])
The location at examples/notetaker-smart/notetaker.py:133 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# api_key="ollama",
The location at examples/notetaker-smart/notetaker.py:147 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-smart/README.md:34 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export ANTHROPIC_API_KEY="sk-ant-..." # or OPENAI_API_KEY, GOOGLE_API_KEY
The location at examples/notetaker-smart/README.md:35 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/notetaker-smart/README.md:46 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export ANTHROPIC_API_KEY="sk-ant-..."
The location at examples/notetaker-smart/README.md:47 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/support-agent/agent.py:54 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/support-agent/agent.py:11 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The location at examples/support-agent/agent.py:51 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at examples/support-agent/agent.py:53 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at examples/support-agent/agent.py:54 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
HEADERS = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}
The location at examples/support-agent/agent.py:57 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# export ANTHROPIC_API_KEY="sk-ant-..."
The location at examples/support-agent/agent.py:156 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# export OPENAI_API_KEY="sk-..."
The location at examples/support-agent/agent.py:175 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# export GOOGLE_API_KEY="..."
The location at examples/support-agent/agent.py:191 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# genai.configure(api_key=os.environ["GOOGLE_API_KEY"])
The location at examples/support-agent/agent.py:195 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
# client = OpenAI(base_url="http://localhost:11434/v1", api_key="ollama")
The location at examples/support-agent/agent.py:211 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at examples/support-agent/README.md:48 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
export ANTHROPIC_API_KEY="sk-ant-..." # or OPENAI_API_KEY, GOOGLE_API_KEY
The location at examples/support-agent/README.md:49 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
Drop the skill into `~/.codex/skills/`, or run `$skill-installer` from your Codex session. (`SKILL.m
The code or instructions at README.md:65 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
- **GitHub Copilot (JetBrains)** — reference from `~/.copilot/agents/*.agent.md`
The code or instructions at README.md:84 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
- **API key persistence** — saved to `~/.agentcall/config.json`, asked once
The code or instructions at README.md:124 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
Set `AGENTCALL_API_KEY=ak_ac_xxx...` in your environment.
The location at references/api.md:37 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
wss://api.agentcall.dev/v1/calls/{call_id}/ws?api_key=ak_ac_xxx
The location at references/api.md:187 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
client = AgentCallClient(api_key="ak_ac_your_key")
The location at references/guides/collaborative-mode.md:392 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
client = AgentCallClient(api_key="ak_ac_xxx")
The location at references/guides/crash-recovery.md:155 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
innerHTML assignment (XSS risk)
document.getElementById('content').innerHTML = slides[current] || '';
The UI code or guide at references/guides/webpage-av-screenshare.md:125 assigns HTML from participant, transcript, slide, or state data. Unescaped meeting-controlled content can create an XSS risk in the local UI.
High
Generic API/secret keys
this.apiKey = apiKey || process.env.AGENTCALL_API_KEY || cfg.api_key || '';
The location at scripts/node/agentcall.js:24 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const uri = `${wsURL}/v1/calls/${callId}/ws?api_key=${this.apiKey}`;
The location at scripts/node/agentcall.js:73 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
console.error('[bridge] API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/con
The code or instructions at scripts/node/bridge-visual.js:129 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
* export AGENTCALL_API_KEY="ak_ac_your_key"
The location at scripts/node/bridge-visual.js:30 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || '';
The location at scripts/node/bridge-visual.js:126 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if (!API_KEY) {
The location at scripts/node/bridge-visual.js:128 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
console.error('[bridge] API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/con
The location at scripts/node/bridge-visual.js:129 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
headers: { 'Authorization': `Bearer ${API_KEY}`, 'Content-Type': 'application/json' },
The location at scripts/node/bridge-visual.js:685 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const wsURI = `${wsURL}/v1/calls/${callId}/ws?api_key=${API_KEY}`;
The location at scripts/node/bridge-visual.js:713 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const wsURI = `${wsURL}/v1/calls/${callId}/ws?api_key=${API_KEY}`;
The location at scripts/node/bridge-visual.js:832 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
console.error('[bridge] API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/con
The code or instructions at scripts/node/bridge.js:54 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
* export AGENTCALL_API_KEY="ak_ac_your_key"
The location at scripts/node/bridge.js:24 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || '';
The location at scripts/node/bridge.js:51 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if (!API_KEY) {
The location at scripts/node/bridge.js:53 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
console.error('[bridge] API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/con
The location at scripts/node/bridge.js:54 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
'Authorization': `Bearer ${API_KEY}`,
The location at scripts/node/bridge.js:347 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const wsURI = `${wsURL}/v1/calls/${callId}/ws?api_key=${API_KEY}`;
The location at scripts/node/bridge.js:377 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
const wsURI = `${wsURL}/v1/calls/${callId}/ws?api_key=${API_KEY}`;
The location at scripts/node/bridge.js:441 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
* Caches results for 7 days at ~/.agentcall/update-check.json.
The code or instructions at scripts/node/check_update.js:11 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
const apiKey = process.env.AGENTCALL_API_KEY;
The location at scripts/node/join.js:94 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
console.error('Error: AGENTCALL_API_KEY environment variable required');
The location at scripts/node/join.js:96 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
"""Load API key: env var first, then ~/.agentcall/config.json."""
The code or instructions at scripts/python/agentcall.py:16 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
"""Load API URL: env var first, then ~/.agentcall/config.json, then default."""
The code or instructions at scripts/python/agentcall.py:30 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
def load_api_key() -> str:
The location at scripts/python/agentcall.py:15 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
key = os.environ.get("AGENTCALL_API_KEY", "")
The location at scripts/python/agentcall.py:17 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
return cfg.get("api_key", "")
The location at scripts/python/agentcall.py:23 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
def __init__(self, api_key: Optional[str] = None, base_url: str = ""):
The location at scripts/python/agentcall.py:46 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
self.api_key = api_key or load_api_key()
The location at scripts/python/agentcall.py:47 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
headers={"Authorization": f"Bearer {self.api_key}"}
The location at scripts/python/agentcall.py:54 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
uri = f"{ws_url}/v1/calls/{call_id}/ws?api_key={self.api_key}"
The location at scripts/python/agentcall.py:107 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at scripts/python/bridge-visual.py:195 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at scripts/python/bridge-visual.py:36 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _config.get("api_key", "")
The location at scripts/python/bridge-visual.py:192 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at scripts/python/bridge-visual.py:194 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at scripts/python/bridge-visual.py:195 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
headers={"Authorization": f"Bearer {API_KEY}"}
The location at scripts/python/bridge-visual.py:523 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
uri = f"{ws_url}/v1/calls/{call_id}/ws?api_key={API_KEY}"
The location at scripts/python/bridge-visual.py:563 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at scripts/python/bridge.py:136 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
export AGENTCALL_API_KEY="ak_ac_your_key"
The location at scripts/python/bridge.py:47 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _config.get("api_key", "")
The location at scripts/python/bridge.py:133 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not API_KEY:
The location at scripts/python/bridge.py:135 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The location at scripts/python/bridge.py:136 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
headers={"Authorization": f"Bearer {API_KEY}"}
The location at scripts/python/bridge.py:402 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
uri = f"{ws_url}/v1/calls/{call_id}/ws?api_key={API_KEY}"
The location at scripts/python/bridge.py:431 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
Caches results for 7 days at ~/.agentcall/update-check.json.
The code or instructions at scripts/python/check_update.py:10 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Generic API/secret keys
api_key = os.environ.get("AGENTCALL_API_KEY", "")
The location at scripts/python/join.py:43 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
if not api_key:
The location at scripts/python/join.py:44 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
print("Error: AGENTCALL_API_KEY environment variable required", file=sys.stderr)
The location at scripts/python/join.py:45 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
client = AgentCallClient(api_key=api_key, base_url=args.api_url)
The location at scripts/python/join.py:48 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
AGENTCALL_API_KEY here — that is for API authentication, not tunnel auth.
The location at scripts/python/tunnel.py:5 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Hidden file in home directory
1. **Check** `~/.agentcall/config.json` — if it exists and has `api_key`, you're ready.
The code or instructions at SKILL.md:42 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
mkdir -p ~/.agentcall
The code or instructions at SKILL.md:50 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
cat > ~/.agentcall/config.json << 'EOF'
The code or instructions at SKILL.md:51 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
`~/.agentcall/config.json` if `AGENTCALL_API_KEY` env var is not set.
The code or instructions at SKILL.md:57 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
**First-call detection:** if `~/.agentcall/config.json` has no `default_mode`
The code or instructions at SKILL.md:69 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
**First call** (no `default_mode` in `~/.agentcall/config.json`): new
The code or instructions at SKILL.md:72 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
Save the choice to `~/.agentcall/config.json`:
The code or instructions at SKILL.md:92 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
`~/.agentcall/config.json`), always use `webpage-av-screenshare` to showcase
The code or instructions at SKILL.md:273 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Hidden file in home directory
The checker caches the result at `~/.agentcall/update-check.json` for 7 days,
The code or instructions at SKILL.md:1847 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
High
Linux /proc filesystem access
- No stdin pipe management (no `/proc/$PID/fd/0` gymnastics, no named pipes).
The instructions at SKILL.md:1550 write commands through /proc/<PID>/fd/0 into a running process. That process file-descriptor manipulation is powerful and easy to misuse.
High
Linux /proc filesystem access
echo '{"command": "tts.speak", "text": "Hello!"}' > /proc/$BRIDGE_PID/fd/0
The instructions at SKILL.md:1593 write commands through /proc/<PID>/fd/0 into a running process. That process file-descriptor manipulation is powerful and easy to misuse.
High
Generic API/secret keys
1. **Check** `~/.agentcall/config.json` — if it exists and has `api_key`, you're ready.
The location at SKILL.md:42 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
2. **Check** `AGENTCALL_API_KEY` env var — if set, you're ready.
The location at SKILL.md:43 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
{"api_key": "USER_KEY_HERE"}
The location at SKILL.md:52 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
`~/.agentcall/config.json` if `AGENTCALL_API_KEY` env var is not set.
The location at SKILL.md:57 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
"api_key": "ak_ac_xxxxx",
The location at SKILL.md:96 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
STATUS=$(curl -s -H "Authorization: Bearer $AGENTCALL_API_KEY" \
The location at SKILL.md:1286 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
STATUS=$(curl -s -H "Authorization: Bearer $AGENTCALL_API_KEY" \
The location at SKILL.md:1290 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
Generic API/secret keys
curl -X DELETE -H "Authorization: Bearer $AGENTCALL_API_KEY" \
The location at SKILL.md:1295 references API keys, bearer authorization, call tokens, or tunnel access credentials. It may not contain a literal secret, but it handles secrets that need protection.
High
innerHTML assignment (XSS risk)
el.innerHTML = Object.values(participants).map(p =>
The UI code or guide at ui-templates/dashboard/index.html:52 assigns HTML from participant, transcript, slide, or state data. Unescaped meeting-controlled content can create an XSS risk in the local UI.
High
innerHTML assignment (XSS risk)
entry.innerHTML = `<div class="speaker">${speaker}</div><div class="text">${text}</div>`;
The UI code or guide at ui-templates/dashboard/index.html:61 assigns HTML from participant, transcript, slide, or state data. Unescaped meeting-controlled content can create an XSS risk in the local UI.
Medium
Hidden file access
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/coding-companion/bridge.py:103 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
cp SKILL-FRAGMENT.md ~/.claude/skills/voice-meeting/SKILL.md
The code or instructions at examples/coding-companion/README.md:131 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
cp bridge.py ~/.claude/skills/voice-meeting/scripts/bridge.py
The code or instructions at examples/coding-companion/README.md:132 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
The key is read from `~/.agentcall/config.json` (persists across sessions) or
The code or instructions at examples/coding-companion/SKILL-FRAGMENT.md:35 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
mkdir -p ~/.agentcall && echo '{"api_key": "KEY_HERE"}' > ~/.agentcall/config.json
The code or instructions at examples/coding-companion/SKILL-FRAGMENT.md:39 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Temp directory access
"command": "bash -c 'EVENTS=/tmp/meeting-events.jsonl; if [ -f \"$EVENTS\" ] && ! grep -q call.ended
The location at examples/coding-companion/SKILL-FRAGMENT.md:168 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Hidden file access
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/meeting-assistant-smart/assistant.py:60 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Python file write/append
with open(filename, "w") as f:
The code at examples/meeting-assistant-smart/assistant.py:338 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
Hidden file access
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/meeting-assistant/assistant.py:48 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Python file write/append
with open(filename, "w") as f:
The code at examples/meeting-assistant/assistant.py:84 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
Hidden file access
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/notetaker-multilingual/notetaker.py:63 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Python file write/append
with wave.open(buf, "wb") as wf:
The code at examples/notetaker-multilingual/notetaker.py:158 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
Python file write/append
with wave.open(filename, "wb") as wf:
The code at examples/notetaker-multilingual/notetaker.py:168 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
Python file write/append
with open(filename, "w") as f:
The code at examples/notetaker-multilingual/notetaker.py:226 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
WebSocket connection
const ws = new WebSocket(wsUrl);
The code or guide at examples/notetaker-simple/notetaker.js:124 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
Node.js fs operations
try { _cfg = JSON.parse(fs.readFileSync(_cfgPath, "utf-8")); } catch {}
The code at examples/notetaker-simple/notetaker.js:26 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Node.js fs operations
fs.writeFileSync(filename, content);
The code at examples/notetaker-simple/notetaker.js:107 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
try { _cfg = JSON.parse(fs.readFileSync(_cfgPath, "utf-8")); } catch {}
The code at examples/notetaker-simple/notetaker.js:26 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
fs.writeFileSync(filename, content);
The code at examples/notetaker-simple/notetaker.js:107 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Hidden file access
console.error("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json");
The code or instructions at examples/notetaker-simple/notetaker.js:33 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/notetaker-simple/notetaker.py:39 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Python file write/append
with open(filename, "w") as f:
The code at examples/notetaker-simple/notetaker.py:78 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
WebSocket connection
const ws = new WebSocket(wsUrl);
The code or guide at examples/notetaker-smart/notetaker.js:261 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
Node.js fs operations
try { _cfg = JSON.parse(fs.readFileSync(_cfgPath, "utf-8")); } catch {}
The code at examples/notetaker-smart/notetaker.js:31 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Node.js fs operations
fs.writeFileSync(filename, content);
The code at examples/notetaker-smart/notetaker.js:245 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
try { _cfg = JSON.parse(fs.readFileSync(_cfgPath, "utf-8")); } catch {}
The code at examples/notetaker-smart/notetaker.js:31 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
fs.writeFileSync(filename, content);
The code at examples/notetaker-smart/notetaker.js:245 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Hidden file access
console.error("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json");
The code or instructions at examples/notetaker-smart/notetaker.js:38 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/notetaker-smart/notetaker.py:39 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Python file write/append
with open(filename, "w") as f:
The code at examples/notetaker-smart/notetaker.py:208 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
Hidden file access
print("Error: Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at examples/support-agent/agent.py:54 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Python file write/append
with open(filename, "w") as f:
The code at examples/support-agent/agent.py:255 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
Hidden file access
Drop the skill into `~/.codex/skills/`, or run `$skill-installer` from your Codex session. (`SKILL.m
The code or instructions at README.md:65 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
- **GitHub Copilot (JetBrains)** — reference from `~/.copilot/agents/*.agent.md`
The code or instructions at README.md:84 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
- **API key persistence** — saved to `~/.agentcall/config.json`, asked once
The code or instructions at README.md:124 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
WebSocket connection
const ws = new WebSocket(wsURL);
The code or guide at references/guides/webpage-audio.md:132 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
const ws = new WebSocket(wsURL);
The code or guide at references/guides/webpage-audio.md:157 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
const ws = new WebSocket(wsURL);
The code or guide at references/guides/webpage-audio.md:341 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
Temp directory access
echo '{"slide": 1}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av-screenshare.md:61 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
The agent creates two files in a local directory (e.g., `/tmp/screenshare/`):
The location at references/guides/webpage-av-screenshare.md:88 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
Serve with: `python -m http.server 3001 --directory /tmp/screenshare/`
The location at references/guides/webpage-av-screenshare.md:136 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
echo '{"slide": 1}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av-screenshare.md:140 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
echo '{"slide": 1}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av-screenshare.md:168 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
echo '{"slide": 3}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av-screenshare.md:171 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
echo '{"slide": 2, "highlight": "revenue"}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av-screenshare.md:174 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
# Setup: agent creates /tmp/screenshare/index.html + state.json, starts HTTP server
The location at references/guides/webpage-av-screenshare.md:210 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
Agent: echo '{"slide": 1}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av-screenshare.md:217 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
Agent: echo '{"slide": 2}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av-screenshare.md:220 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
Agent: echo '{"slide": 1}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av-screenshare.md:224 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
python -m http.server 3001 --directory /tmp/my-slides/
The location at references/guides/webpage-av-screenshare.md:239 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
WebSocket connection
const ws = new WebSocket(wsURL);
The code or guide at references/guides/webpage-av.md:23 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
Temp directory access
# Agent creates /tmp/screenshare/state.json with current data
The location at references/guides/webpage-av.md:55 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
echo '{"chart": "revenue", "data": {"revenue": 2.4, "growth": 15}}' > /tmp/screenshare/state.json
The location at references/guides/webpage-av.md:56 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
WebSocket connection
this.ws = new WebSocket(uri);
The code or guide at scripts/node/agentcall.js:76 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
Synchronous file operations
import { readFileSync, existsSync } from 'fs';
The code at scripts/node/agentcall.js:5 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
return JSON.parse(readFileSync(CONFIG_PATH, 'utf-8'));
The code at scripts/node/agentcall.js:15 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
WebSocket connection
this.ws = new WebSocket(this.tunnelWSURL);
The code or guide at scripts/node/bridge-visual.js:576 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
const newWs = new WebSocket(wsURI);
The code or guide at scripts/node/bridge-visual.js:723 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
ws = new WebSocket(wsURI);
The code or guide at scripts/node/bridge-visual.js:835 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
Hardcoded IP address
const socket = createConnection({ host: '127.0.0.1', port });
The code at scripts/node/bridge-visual.js:64 connects to localhost ports for AgentCall tunnel routing. This is intended, but a wrong port can expose local services through the tunnel.
Medium
Hardcoded IP address
server.listen(0, '127.0.0.1', () => {
The code at scripts/node/bridge-visual.js:549 connects to localhost ports for AgentCall tunnel routing. This is intended, but a wrong port can expose local services through the tunnel.
Medium
Synchronous file operations
import { readFileSync, existsSync, appendFileSync, readdirSync, statSync } from 'fs';
The code at scripts/node/bridge-visual.js:39 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
try { _cfg = JSON.parse(readFileSync(CONFIG_PATH, 'utf-8')); } catch {}
The code at scripts/node/bridge-visual.js:122 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
try { appendFileSync(outputFile, line + '\n'); } catch {}
The code at scripts/node/bridge-visual.js:214 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
res.end(readFileSync(sharedJsPath, 'utf-8'));
The code at scripts/node/bridge-visual.js:510 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
res.end(readFileSync(filePath));
The code at scripts/node/bridge-visual.js:545 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Hidden file access
console.error('[bridge] API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/con
The code or instructions at scripts/node/bridge-visual.js:129 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
WebSocket connection
const newWs = new WebSocket(wsURI);
The code or guide at scripts/node/bridge.js:387 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
ws = new WebSocket(wsURI);
The code or guide at scripts/node/bridge.js:444 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
Synchronous file operations
import { readFileSync, existsSync, appendFileSync } from 'fs';
The code at scripts/node/bridge.js:34 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
try { _cfg = JSON.parse(readFileSync(CONFIG_PATH, 'utf-8')); } catch {}
The code at scripts/node/bridge.js:47 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
try { appendFileSync(outputFile, line + '\n'); } catch {}
The code at scripts/node/bridge.js:125 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Hidden file access
console.error('[bridge] API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/con
The code or instructions at scripts/node/bridge.js:54 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Synchronous file operations
import { readFileSync, writeFileSync, mkdirSync } from 'fs';
The code at scripts/node/check_update.js:16 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
const raw = readFileSync(pluginJsonPath(), 'utf8');
The code at scripts/node/check_update.js:47 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
const raw = readFileSync(cachePath(), 'utf8');
The code at scripts/node/check_update.js:80 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
writeFileSync(cachePath(), JSON.stringify(data));
The code at scripts/node/check_update.js:90 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Hidden file access
* Reads current version from ../../.claude-plugin/plugin.json, fetches the
The code or instructions at scripts/node/check_update.js:9 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
* Caches results for 7 days at ~/.agentcall/update-check.json.
The code or instructions at scripts/node/check_update.js:11 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
const GITHUB_PLUGIN_URL = 'https://raw.githubusercontent.com/pattern-ai-labs/agentcall/main/.claude-
The code or instructions at scripts/node/check_update.js:25 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Synchronous file operations
import { readFileSync, writeFileSync, unlinkSync, existsSync } from 'fs';
The code at scripts/node/join.js:9 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
const data = JSON.parse(readFileSync(STATE_FILE, 'utf8'));
The code at scripts/node/join.js:64 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
Synchronous file operations
writeFileSync(STATE_FILE, JSON.stringify({
The code at scripts/node/join.js:80 reads config, templates, or local files for the meeting bridge. Filesystem access is required but should remain tightly scoped.
Medium
WebSocket connection
this.ws = new WebSocket(this.tunnelWSURL);
The code or guide at scripts/node/tunnel.js:21 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
Hidden file access
"""Load API key: env var first, then ~/.agentcall/config.json."""
The code or instructions at scripts/python/agentcall.py:16 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
"""Load API URL: env var first, then ~/.agentcall/config.json, then default."""
The code or instructions at scripts/python/agentcall.py:30 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hardcoded IP address
site = web.TCPSite(runner, "127.0.0.1", 0)
The code at scripts/python/bridge-visual.py:716 connects to localhost ports for AgentCall tunnel routing. This is intended, but a wrong port can expose local services through the tunnel.
Medium
Hardcoded IP address
if not _is_port_reachable("127.0.0.1", port):
The code at scripts/python/bridge-visual.py:1042 connects to localhost ports for AgentCall tunnel routing. This is intended, but a wrong port can expose local services through the tunnel.
Medium
Hardcoded IP address
if not _is_port_reachable("127.0.0.1", new_port):
The code at scripts/python/bridge-visual.py:1088 connects to localhost ports for AgentCall tunnel routing. This is intended, but a wrong port can expose local services through the tunnel.
Medium
Hidden file access
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at scripts/python/bridge-visual.py:195 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Python file write/append
with open(_output_file, "a") as f:
The code at scripts/python/bridge-visual.py:148 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
Hidden file access
emit_err("API key not found. Set AGENTCALL_API_KEY env var or save to ~/.agentcall/config.json")
The code or instructions at scripts/python/bridge.py:136 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Python file write/append
with open(_output_file, "a") as f:
The code at scripts/python/bridge.py:89 writes meeting logs, transcripts, audio, or state files. This can store sensitive meeting content on disk.
Medium
Hidden file access
Reads current version from ../../.claude-plugin/plugin.json, fetches the latest
The code or instructions at scripts/python/check_update.py:8 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
Caches results for 7 days at ~/.agentcall/update-check.json.
The code or instructions at scripts/python/check_update.py:10 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
GITHUB_PLUGIN_URL = "https://raw.githubusercontent.com/pattern-ai-labs/agentcall/main/.claude-plugin
The code or instructions at scripts/python/check_update.py:24 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Shell command substitution
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
The launcher at scripts/run.sh:3 uses shell command substitution to locate its script directory before executing local Python or Node clients. This is intended but still local shell execution.
Medium
Unix shell invocation
#!/bin/bash
The file at scripts/run.sh:1 is an executable shell launcher that dispatches to the Python or Node meeting client. This intentionally runs local scripts with user-supplied arguments.
Medium
Hidden file access
1. **Check** `~/.agentcall/config.json` — if it exists and has `api_key`, you're ready.
The code or instructions at SKILL.md:42 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
mkdir -p ~/.agentcall
The code or instructions at SKILL.md:50 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
cat > ~/.agentcall/config.json << 'EOF'
The code or instructions at SKILL.md:51 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
`~/.agentcall/config.json` if `AGENTCALL_API_KEY` env var is not set.
The code or instructions at SKILL.md:57 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
**First-call detection:** if `~/.agentcall/config.json` has no `default_mode`
The code or instructions at SKILL.md:69 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
**First call** (no `default_mode` in `~/.agentcall/config.json`): new
The code or instructions at SKILL.md:72 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
Save the choice to `~/.agentcall/config.json`:
The code or instructions at SKILL.md:92 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
`~/.agentcall/config.json`), always use `webpage-av-screenshare` to showcase
The code or instructions at SKILL.md:273 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Hidden file access
The checker caches the result at `~/.agentcall/update-check.json` for 7 days,
The code or instructions at SKILL.md:1847 read or write ~/.agentcall/config.json. That hidden home config can contain plaintext API keys and user defaults.
Medium
Temp directory access
→ agent creates /tmp/screenshare/index.html + state.json
The location at SKILL.md:235 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
→ agent starts: python -m http.server 3001 --directory /tmp/screenshare/
The location at SKILL.md:236 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
→ agent writes: echo '{"slide": 1}' > /tmp/screenshare/state.json
The location at SKILL.md:240 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
→ agent writes: echo '{"slide": 2}' > /tmp/screenshare/state.json
The location at SKILL.md:244 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
Agent writes: echo '{"slide": 1}' > /tmp/screenshare/state.json
The location at SKILL.md:971 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
python -m http.server 3002 --directory /tmp/my-report/
The location at SKILL.md:1027 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
python -m http.server 3001 --directory /tmp/screenshare/ &
The location at SKILL.md:1275 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
--output /tmp/meeting-events.jsonl 2>/tmp/meeting.err &
The location at SKILL.md:1586 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
tail -n 5 /tmp/meeting-events.jsonl
The location at SKILL.md:1590 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
mkfifo /tmp/meeting-stdin
The location at SKILL.md:1599 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
--output /tmp/meeting-events.jsonl < /tmp/meeting-stdin 2>/tmp/meeting.err &
The location at SKILL.md:1601 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
exec 3>/tmp/meeting-stdin
The location at SKILL.md:1604 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
rm /tmp/meeting-stdin
The location at SKILL.md:1611 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
1. Start bridge.py in background with --output /tmp/meeting-events.jsonl
The location at SKILL.md:1623 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
a. CHECK CALL: tail -n 20 /tmp/meeting-events.jsonl
The location at SKILL.md:1627 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
"command": "bash -c 'EVENTS=/tmp/meeting-events.jsonl; if [ -f \"$EVENTS\" ] && ! grep -q call.ended
The location at SKILL.md:1692 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
Temp directory access
- The hook checks if `/tmp/meeting-events.jsonl` exists AND does NOT contain `call.ended`
The location at SKILL.md:1704 uses /tmp for screenshare, webpage, or event files that may contain meeting content. Temporary files can persist or be readable by local users if not cleaned up.
Medium
WebSocket connection
ws = new WebSocket(wsURL);
The code or guide at ui-templates/avatar/index.html:201 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
ws = new WebSocket(wsURL);
The code or guide at ui-templates/blank/index.html:31 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
ws = new WebSocket(wsURL);
The code or guide at ui-templates/dashboard/index.html:69 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
ws = new WebSocket(wsURL);
The code or guide at ui-templates/orb/index.html:125 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
ws = new WebSocket(wsURL);
The code or guide at ui-templates/pattern/index.html:300 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
ws = new WebSocket(wsURL);
The code or guide at ui-templates/ring/index.html:178 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Medium
WebSocket connection
ws = new WebSocket(wsURL);
The code or guide at ui-templates/voice-agent/index.html:189 opens WebSocket channels for call events, UI updates, or tunnel traffic. These channels can carry transcripts, commands, media, and credentials.
Low
Hardcoded URL
{"command": "send_chat", "message": "Here's the URL: https://..."}
The URL at examples/coding-companion/bridge.py:40 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge.py "https://meet.google.com/abc-def-ghi"
The URL at examples/coding-companion/bridge.py:46 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge.py "https://meet.google.com/abc" --name "Claude" --voice af_bella --vad-timeout 3.0
The URL at examples/coding-companion/bridge.py:49 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The URL at examples/coding-companion/bridge.py:99 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The code at examples/coding-companion/bridge.py:99 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The code at examples/coding-companion/bridge.py:100 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python HTTP libraries
flood it with requests."
The hit at examples/coding-companion/README.md:70 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
Agent: runs curl https://api.agentcall.dev/health
The URL at examples/coding-companion/README.md:23 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
You (typing): "join this meeting: https://meet.google.com/abc-def-ghi"
The URL at examples/coding-companion/README.md:30 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge.py "https://meet.google.com/abc-def-ghi" --name "Claude"
The URL at examples/coding-companion/README.md:149 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
echo '{"command": "tts.speak", "text": "Hello!"}' | python bridge.py "https://meet.google.com/abc"
The URL at examples/coding-companion/README.md:155 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge.py "https://meet.google.com/abc"
The URL at examples/coding-companion/README.md:192 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge.py "https://meet.google.com/abc" --vad-timeout 3.5
The URL at examples/coding-companion/README.md:195 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge.py "https://meet.google.com/abc" --vad-timeout 1.0
The URL at examples/coding-companion/README.md:198 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"command": "send_chat", "message": "Here's the deployment URL: https://agentcall.dev"}
The URL at examples/coding-companion/README.md:225 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python scripts/python/bridge.py "https://meet.google.com/abc-def-ghi" --name "Claude" --voice af_hea
The URL at examples/coding-companion/SKILL-FRAGMENT.md:31 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
(You run: curl https://api.agentcall.dev/health → {"status":"ok"})
The URL at examples/coding-companion/SKILL-FRAGMENT.md:83 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
→ stdin: {"command": "send_chat", "message": "https://agentcall.dev"}
The URL at examples/coding-companion/SKILL-FRAGMENT.md:90 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python HTTP libraries
resp = requests.post(
The hit at examples/meeting-assistant-smart/assistant.py:303 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call_id}", headers=HEADERS)
The hit at examples/meeting-assistant-smart/assistant.py:511 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call['call_id']}", headers=HEADERS)
The hit at examples/meeting-assistant-smart/assistant.py:569 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc-def-ghi"
The URL at examples/meeting-assistant-smart/assistant.py:29 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The URL at examples/meeting-assistant-smart/assistant.py:56 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc-def-ghi"
The URL at examples/meeting-assistant-smart/assistant.py:525 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --name "Aria" --triggers "aria,hey aria"
The URL at examples/meeting-assistant-smart/assistant.py:526 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --voice voice.bella
The URL at examples/meeting-assistant-smart/assistant.py:527 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The code at examples/meeting-assistant-smart/assistant.py:56 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The code at examples/meeting-assistant-smart/assistant.py:57 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
# genai.configure(api_key=os.environ["GOOGLE_API_KEY"])
The code at examples/meeting-assistant-smart/assistant.py:209 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc-def-ghi"
The URL at examples/meeting-assistant-smart/README.md:148 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc-def-ghi"
The URL at examples/meeting-assistant-smart/README.md:155 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --name "Aria" --triggers "aria,hey aria"
The URL at examples/meeting-assistant-smart/README.md:158 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --voice voice.bella
The URL at examples/meeting-assistant-smart/README.md:161 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
# resp = await client.get(f"https://api.yourcompany.com/data", params={"q": query})
The URL at examples/meeting-assistant-smart/tools.py:50 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python HTTP libraries
resp = requests.post(
The hit at examples/meeting-assistant/assistant.py:56 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call_id}", headers=HEADERS)
The hit at examples/meeting-assistant/assistant.py:200 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call['call_id']}", headers=HEADERS)
The hit at examples/meeting-assistant/assistant.py:256 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc-def-ghi"
The URL at examples/meeting-assistant/assistant.py:16 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --name "Juno" --triggers "juno,zuno,assistant"
The URL at examples/meeting-assistant/assistant.py:19 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The URL at examples/meeting-assistant/assistant.py:44 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc-def-ghi"
The URL at examples/meeting-assistant/assistant.py:216 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --name "Aria" --triggers "aria,hey aria"
The URL at examples/meeting-assistant/assistant.py:219 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --voice voice.bella
The URL at examples/meeting-assistant/assistant.py:222 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The code at examples/meeting-assistant/assistant.py:44 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The code at examples/meeting-assistant/assistant.py:45 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc-def-ghi"
The URL at examples/meeting-assistant/README.md:34 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc-def-ghi"
The URL at examples/meeting-assistant/README.md:41 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --name "Aria" --triggers "aria,hey aria"
The URL at examples/meeting-assistant/README.md:44 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --voice voice.bella
The URL at examples/meeting-assistant/README.md:47 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --context "You are a financial analyst. Answer wit
The URL at examples/meeting-assistant/README.md:50 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python assistant.py "https://meet.google.com/abc" --output standup-log.md
The URL at examples/meeting-assistant/README.md:53 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python HTTP libraries
resp = requests.post(
The hit at examples/notetaker-multilingual/notetaker.py:198 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call_id}", headers=HEADERS)
The hit at examples/notetaker-multilingual/notetaker.py:304 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call['call_id']}", headers=HEADERS)
The hit at examples/notetaker-multilingual/notetaker.py:388 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-multilingual/notetaker.py:16 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --save-audio
The URL at examples/notetaker-multilingual/notetaker.py:19 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --output standup.md
The URL at examples/notetaker-multilingual/notetaker.py:22 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The URL at examples/notetaker-multilingual/notetaker.py:58 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-multilingual/notetaker.py:351 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --save-audio
The URL at examples/notetaker-multilingual/notetaker.py:354 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --with-english-stt
The URL at examples/notetaker-multilingual/notetaker.py:357 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --name "Translator" --output standup.md
The URL at examples/notetaker-multilingual/notetaker.py:360 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The code at examples/notetaker-multilingual/notetaker.py:58 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The code at examples/notetaker-multilingual/notetaker.py:59 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
GOOGLE_API_KEY = os.environ.get("GOOGLE_API_KEY", "")
The code at examples/notetaker-multilingual/notetaker.py:60 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-multilingual/README.md:37 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --with-english-stt
The URL at examples/notetaker-multilingual/README.md:41 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --save-audio
The URL at examples/notetaker-multilingual/README.md:44 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --name "Translator" --output standup.md
The URL at examples/notetaker-multilingual/README.md:47 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --name "Scribe" --save-audio --with-english-stt --
The URL at examples/notetaker-multilingual/README.md:50 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Fetch API call
const resp = await fetch(`${API_BASE}/v1/calls`, {
The hit at examples/notetaker-simple/notetaker.js:54 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Fetch API call
const resp = await fetch(
The hit at examples/notetaker-simple/notetaker.js:73 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Fetch API call
await fetch(`${API_BASE}/calls/${callId}`, { method: "DELETE", headers: HEADERS });
The hit at examples/notetaker-simple/notetaker.js:211 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
* node notetaker.js "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-simple/notetaker.js:10 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
* node notetaker.js "https://meet.google.com/abc-def-ghi" --name "Scribe"
The URL at examples/notetaker-simple/notetaker.js:13 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || "https://api.agentcall.dev";
The URL at examples/notetaker-simple/notetaker.js:29 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Node.js fs stat operations
if (fs.existsSync(_cfgPath)) {
The code at examples/notetaker-simple/notetaker.js:25 checks local config or template paths. This is low-risk but real filesystem access.
Low
Environment variable access (dot notation)
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || "https://api.agentcall.dev";
The code at examples/notetaker-simple/notetaker.js:29 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable access (dot notation)
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || "";
The code at examples/notetaker-simple/notetaker.js:30 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || "https://api.agentcall.dev";
The code at examples/notetaker-simple/notetaker.js:29 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || "";
The code at examples/notetaker-simple/notetaker.js:30 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python HTTP libraries
resp = requests.post(
The hit at examples/notetaker-simple/notetaker.py:47 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
resp = requests.get(
The hit at examples/notetaker-simple/notetaker.py:64 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call_id}", headers=HEADERS)
The hit at examples/notetaker-simple/notetaker.py:159 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call['call_id']}", headers=HEADERS)
The hit at examples/notetaker-simple/notetaker.py:207 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-simple/notetaker.py:10 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi" --name "Scribe"
The URL at examples/notetaker-simple/notetaker.py:13 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The URL at examples/notetaker-simple/notetaker.py:35 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The code at examples/notetaker-simple/notetaker.py:35 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The code at examples/notetaker-simple/notetaker.py:36 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-simple/README.md:26 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
node notetaker.js "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-simple/README.md:34 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi" --name "Scribe"
The URL at examples/notetaker-simple/README.md:41 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
node notetaker.js "https://meet.google.com/abc-def-ghi" --name "Scribe"
The URL at examples/notetaker-simple/README.md:42 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Fetch API call
const resp = await fetch(`${API_BASE}/v1/calls`, {
The hit at examples/notetaker-smart/notetaker.js:175 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Fetch API call
const resp = await fetch(
The hit at examples/notetaker-smart/notetaker.js:191 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Fetch API call
await fetch(`${API_BASE}/calls/${callId}`, { method: "DELETE", headers: HEADERS });
The hit at examples/notetaker-smart/notetaker.js:350 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
* node notetaker.js "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-smart/notetaker.js:10 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
* node notetaker.js "https://meet.google.com/abc-def-ghi" --name "Scribe" --output summary.md
The URL at examples/notetaker-smart/notetaker.js:13 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || "https://api.agentcall.dev";
The URL at examples/notetaker-smart/notetaker.js:34 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
// baseURL: "http://localhost:11434/v1", // Ollama
The URL at examples/notetaker-smart/notetaker.js:155 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Node.js fs stat operations
if (fs.existsSync(_cfgPath)) {
The code at examples/notetaker-smart/notetaker.js:30 checks local config or template paths. This is low-risk but real filesystem access.
Low
Environment variable access (dot notation)
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || "https://api.agentcall.dev";
The code at examples/notetaker-smart/notetaker.js:34 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable access (dot notation)
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || "";
The code at examples/notetaker-smart/notetaker.js:35 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable access (dot notation)
// const genAI = new GoogleGenerativeAI(process.env.GOOGLE_API_KEY);
The code at examples/notetaker-smart/notetaker.js:143 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || "https://api.agentcall.dev";
The code at examples/notetaker-smart/notetaker.js:34 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || "";
The code at examples/notetaker-smart/notetaker.js:35 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
// const genAI = new GoogleGenerativeAI(process.env.GOOGLE_API_KEY);
The code at examples/notetaker-smart/notetaker.js:143 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python HTTP libraries
resp = requests.post(
The hit at examples/notetaker-smart/notetaker.py:164 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
resp = requests.get(f"{API_BASE}/v1/calls/{call_id}/transcript?format=json", headers=HEADERS)
The hit at examples/notetaker-smart/notetaker.py:180 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call_id}", headers=HEADERS)
The hit at examples/notetaker-smart/notetaker.py:289 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
requests.delete(f"{API_BASE}/v1/calls/{call['call_id']}", headers=HEADERS)
The hit at examples/notetaker-smart/notetaker.py:339 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-smart/notetaker.py:10 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi" --name "Scribe" --output summary.md
The URL at examples/notetaker-smart/notetaker.py:13 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The URL at examples/notetaker-smart/notetaker.py:35 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
# base_url="http://localhost:11434/v1", # Ollama
The URL at examples/notetaker-smart/notetaker.py:146 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The code at examples/notetaker-smart/notetaker.py:35 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The code at examples/notetaker-smart/notetaker.py:36 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
# genai.configure(api_key=os.environ["GOOGLE_API_KEY"])
The code at examples/notetaker-smart/notetaker.py:133 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-smart/README.md:37 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
node notetaker.js "https://meet.google.com/abc-def-ghi"
The URL at examples/notetaker-smart/README.md:49 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --name "Scribe"
The URL at examples/notetaker-smart/README.md:56 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python notetaker.py "https://meet.google.com/abc" --output weekly-standup.md
The URL at examples/notetaker-smart/README.md:59 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python HTTP libraries
resp = requests.post(
The hit at examples/support-agent/agent.py:235 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc-def-ghi"
The URL at examples/support-agent/agent.py:12 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc" --name "Sarah" --voice af_bella
The URL at examples/support-agent/agent.py:15 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The URL at examples/support-agent/agent.py:50 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
# client = OpenAI(base_url="http://localhost:11434/v1", api_key="ollama")
The URL at examples/support-agent/agent.py:211 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc-def-ghi"
The URL at examples/support-agent/agent.py:417 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc" --name "Sarah" --voice af_bella
The URL at examples/support-agent/agent.py:418 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc" --output call-log.md
The URL at examples/support-agent/agent.py:419 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _cfg.get("api_url", "") or "https://api.agentc
The code at examples/support-agent/agent.py:50 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _cfg.get("api_key", "")
The code at examples/support-agent/agent.py:51 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
# genai.configure(api_key=os.environ["GOOGLE_API_KEY"])
The code at examples/support-agent/agent.py:195 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc-def-ghi"
The URL at examples/support-agent/README.md:51 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc" --name "Sarah"
The URL at examples/support-agent/README.md:58 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc" --voice af_bella
The URL at examples/support-agent/README.md:61 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python agent.py "https://meet.google.com/abc" --output call-log.md
The URL at examples/support-agent/README.md:64 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
gemini extensions install https://github.com/pattern-ai-labs/agentcall
The URL at README.md:70 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
git clone https://github.com/pattern-ai-labs/agentcall.git
The URL at README.md:78 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
curl -X POST https://api.agentcall.dev/v1/auth/register \
The URL at references/api.md:12 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
curl -X POST https://api.agentcall.dev/v1/auth/login \
The URL at references/api.md:18 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
curl -X POST https://api.agentcall.dev/v1/auth/api-keys \
The URL at references/api.md:24 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
curl https://api.agentcall.dev/v1/auth/credits \
The URL at references/api.md:32 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"meet_url": "https://meet.google.com/abc-def-ghi",
The URL at references/api.md:47 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"webhook_url": "https://my-server.com/webhooks",
The URL at references/api.md:59 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"webpage_url": "https://your-site.com/bot",
The URL at references/api.md:70 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"screenshare_url": "https://your-site.com/screenshare"
The URL at references/api.md:71 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"tunnel_url": "https://x8f2k.conn.agentcall.dev/k/a7b2c.../ui",
The URL at references/api.md:81 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"meet_url": "https://meet.google.com/abc-def-ghi",
The URL at references/api.md:99 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"meet_url": "https://meet.google.com/abc-def-ghi",
The URL at references/api.md:116 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
meet_url="https://meet.google.com/abc-def-ghi",
The URL at references/guides/collaborative-mode.md:32 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
meet_url="https://meet.google.com/abc-def-ghi",
The URL at references/guides/collaborative-mode.md:395 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"meet_url": "https://meet.google.com/xyz",
The URL at references/guides/crash-recovery.md:135 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
meet_url="https://meet.google.com/abc",
The URL at references/guides/crash-recovery.md:177 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
<script src="https://cdn.jsdelivr.net/npm/onnxruntime-web@1.17.0/dist/ort.min.js"></script>
The URL at references/guides/interruption-handling.md:125 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Fetch API call
const r = await fetch('/state.json?t=' + Date.now());
The hit at references/guides/webpage-av-screenshare.md:121 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
./scripts/run.sh https://meet.google.com/abc \
The URL at references/guides/webpage-av-screenshare.md:33 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
./scripts/run.sh https://meet.google.com/abc \
The URL at references/guides/webpage-av-screenshare.md:39 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
--webpage-url https://brand.com/avatar \
The URL at references/guides/webpage-av-screenshare.md:41 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
./scripts/run.sh https://meet.google.com/abc \
The URL at references/guides/webpage-av-screenshare.md:45 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
--webpage-url https://brand.com/avatar \
The URL at references/guides/webpage-av-screenshare.md:47 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
--screenshare-url https://slides.com/deck
The URL at references/guides/webpage-av-screenshare.md:48 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"command": "screenshare.start", "url": "https://your-slides.com/deck"}
The URL at references/guides/webpage-av-screenshare.md:152 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"command": "screenshare.swap", "url": "https://different-page.com"}
The URL at references/guides/webpage-av-screenshare.md:192 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Fetch API call
const r = await fetch('/state.json?t=' + Date.now());
The hit at references/guides/webpage-av.md:63 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
./scripts/run.sh https://meet.google.com/abc-def-ghi \
The URL at references/guides/webpage-av.md:100 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
--webpage-url https://support.acme.com/agent
The URL at references/guides/webpage-av.md:102 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Fetch API call
const resp = await fetch(url, opts);
The hit at scripts/node/agentcall.js:39 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
this.baseURL = baseURL || process.env.AGENTCALL_API_URL || cfg.api_url || 'https://api.agentcall.dev
The URL at scripts/node/agentcall.js:25 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Environment variable access (dot notation)
this.apiKey = apiKey || process.env.AGENTCALL_API_KEY || cfg.api_key || '';
The code at scripts/node/agentcall.js:24 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable access (dot notation)
this.baseURL = baseURL || process.env.AGENTCALL_API_URL || cfg.api_url || 'https://api.agentcall.dev
The code at scripts/node/agentcall.js:25 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
this.apiKey = apiKey || process.env.AGENTCALL_API_KEY || cfg.api_key || '';
The code at scripts/node/agentcall.js:24 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
this.baseURL = baseURL || process.env.AGENTCALL_API_URL || cfg.api_url || 'https://api.agentcall.dev
The code at scripts/node/agentcall.js:25 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Fetch API call
const resp = await fetch(url, opts);
The hit at scripts/node/bridge-visual.js:688 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
HTTP/HTTPS request
if (msg.type === 'http.request') {
The hit at scripts/node/bridge-visual.js:594 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
* {"command": "screenshare.start", "url": "https://slides.google.com/..."}
The URL at scripts/node/bridge-visual.js:22 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
* {"command": "screenshare.swap", "url": "https://..."} // atomic stop+start
The URL at scripts/node/bridge-visual.js:25 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
* node bridge-visual.js "https://meet.google.com/abc" --name "Claude"
The URL at scripts/node/bridge-visual.js:31 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
* node bridge-visual.js "https://meet.google.com/abc" --webpage-url "https://your-site.com/avata
The URL at scripts/node/bridge-visual.js:32 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
* node bridge-visual.js "https://meet.google.com/abc" --ui-port 3000
The URL at scripts/node/bridge-visual.js:33 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
// (https://tunnel/screenshare/) doesn't change.
The URL at scripts/node/bridge-visual.js:53 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || 'https://api.agentcall.dev';
The URL at scripts/node/bridge-visual.js:125 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Environment variable access (dot notation)
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || 'https://api.agentcall.dev';
The code at scripts/node/bridge-visual.js:125 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable access (dot notation)
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || '';
The code at scripts/node/bridge-visual.js:126 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || 'https://api.agentcall.dev';
The code at scripts/node/bridge-visual.js:125 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || '';
The code at scripts/node/bridge-visual.js:126 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Fetch API call
const resp = await fetch(url, opts);
The hit at scripts/node/bridge.js:352 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
* node bridge.js "https://meet.google.com/abc-def-ghi"
The URL at scripts/node/bridge.js:25 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
* node bridge.js "https://meet.google.com/abc" --name "Claude" --voice af_bella --vad-timeout 2.
The URL at scripts/node/bridge.js:28 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || 'https://api.agentcall.dev';
The URL at scripts/node/bridge.js:50 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Environment variable access (dot notation)
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || 'https://api.agentcall.dev';
The code at scripts/node/bridge.js:50 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable access (dot notation)
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || '';
The code at scripts/node/bridge.js:51 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const API_BASE = process.env.AGENTCALL_API_URL || _cfg.api_url || 'https://api.agentcall.dev';
The code at scripts/node/bridge.js:50 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const API_KEY = process.env.AGENTCALL_API_KEY || _cfg.api_key || '';
The code at scripts/node/bridge.js:51 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
HTTP/HTTPS get
const req = https.get(
The hit at scripts/node/check_update.js:109 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
const REPO_URL = 'https://github.com/pattern-ai-labs/agentcall';
The URL at scripts/node/check_update.js:24 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
const GITHUB_PLUGIN_URL = 'https://raw.githubusercontent.com/pattern-ai-labs/agentcall/main/.claude-
The URL at scripts/node/check_update.js:25 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
apiURL: 'https://api.agentcall.dev',
The URL at scripts/node/join.js:28 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Environment variable access (dot notation)
const apiKey = process.env.AGENTCALL_API_KEY;
The code at scripts/node/join.js:94 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Environment variable object
const apiKey = process.env.AGENTCALL_API_KEY;
The code at scripts/node/join.js:94 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
HTTP/HTTPS request
if (type === 'http.request') {
The hit at scripts/node/tunnel.js:58 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
HTTP/HTTPS request
const req = http.request(options, (res) => {
The hit at scripts/node/tunnel.js:79 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
HTTP client library
const req = http.request(options, (res) => {
The hit at scripts/node/tunnel.js:79 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
self.base_url = base_url or load_api_url() or "https://api.agentcall.dev"
The URL at scripts/python/agentcall.py:48 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
key = os.environ.get("AGENTCALL_API_KEY", "")
The code at scripts/python/agentcall.py:17 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
url = os.environ.get("AGENTCALL_API_URL", "")
The code at scripts/python/agentcall.py:31 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
HTTP/HTTPS request
if msg_type == "http.request":
The hit at scripts/python/bridge-visual.py:779 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
HTTP client library
async with session.request(method, local_url, headers=headers,
The hit at scripts/python/bridge-visual.py:801 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
{"event": "screenshare.started", "url": "https://..."}
The URL at scripts/python/bridge-visual.py:24 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"command": "screenshare.start", "url": "https://slides.google.com/..."}
The URL at scripts/python/bridge-visual.py:29 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"command": "screenshare.swap", "url": "https://..."} — atomic stop+start
The URL at scripts/python/bridge-visual.py:32 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge-visual.py "https://meet.google.com/abc" --name "Claude"
The URL at scripts/python/bridge-visual.py:39 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge-visual.py "https://meet.google.com/abc" --webpage-url "https://your-site.com/avatar"
The URL at scripts/python/bridge-visual.py:42 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge-visual.py "https://meet.google.com/abc" --ui-port 3000
The URL at scripts/python/bridge-visual.py:45 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
# content because the URL (https://tunnel/screenshare/) doesn't change.
The URL at scripts/python/bridge-visual.py:73 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _config.get("api_url", "") or "https://api.age
The URL at scripts/python/bridge-visual.py:191 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
return f"http://localhost:{self.screenshare_port}{local_path}"
The URL at scripts/python/bridge-visual.py:765 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
return f"http://localhost:{self.webpage_port}{local_path}"
The URL at scripts/python/bridge-visual.py:768 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
return f"http://localhost:{self.ui_port}{local_path}"
The URL at scripts/python/bridge-visual.py:771 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
return f"http://localhost:{self.ui_port}{path}"
The URL at scripts/python/bridge-visual.py:772 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
# {"command": "screenshare.start", "url": "https://..."} — public URL
The URL at scripts/python/bridge-visual.py:1034 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge-visual.py "https://meet.google.com/abc" --name Claude
The URL at scripts/python/bridge-visual.py:1603 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge-visual.py "https://meet.google.com/abc" --webpage-url "https://your-site.com/avatar"
The URL at scripts/python/bridge-visual.py:1606 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge-visual.py "https://meet.google.com/abc" --screenshare-port 3001
The URL at scripts/python/bridge-visual.py:1609 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
stdin: {"command": "screenshare.start", "url": "https://slides.google.com/..."}
The URL at scripts/python/bridge-visual.py:1612 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _config.get("api_url", "") or "https://api.age
The code at scripts/python/bridge-visual.py:191 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _config.get("api_key", "")
The code at scripts/python/bridge-visual.py:192 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Configuration library
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _config.get("api_url", "") or "https://api.age
The code at scripts/python/bridge-visual.py:191 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Configuration library
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _config.get("api_key", "")
The code at scripts/python/bridge-visual.py:192 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Hardcoded URL
{"command": "send_chat", "message": "Here's the URL: https://..."}
The URL at scripts/python/bridge.py:42 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge.py "https://meet.google.com/abc-def-ghi"
The URL at scripts/python/bridge.py:48 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python bridge.py "https://meet.google.com/abc" --name "Claude" --voice af_bella --vad-timeout 2.0
The URL at scripts/python/bridge.py:51 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _config.get("api_url", "") or "https://api.age
The URL at scripts/python/bridge.py:132 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _config.get("api_url", "") or "https://api.age
The code at scripts/python/bridge.py:132 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python environment access
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _config.get("api_key", "")
The code at scripts/python/bridge.py:133 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Configuration library
API_BASE = os.environ.get("AGENTCALL_API_URL", "") or _config.get("api_url", "") or "https://api.age
The code at scripts/python/bridge.py:132 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Configuration library
API_KEY = os.environ.get("AGENTCALL_API_KEY", "") or _config.get("api_key", "")
The code at scripts/python/bridge.py:133 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
Python HTTP libraries
import urllib.request
The hit at scripts/python/check_update.py:18 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
req = urllib.request.Request(
The hit at scripts/python/check_update.py:105 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Python HTTP libraries
with urllib.request.urlopen(req, timeout=FETCH_TIMEOUT) as resp:
The hit at scripts/python/check_update.py:109 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
REPO_URL = "https://github.com/pattern-ai-labs/agentcall"
The URL at scripts/python/check_update.py:23 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
GITHUB_PLUGIN_URL = "https://raw.githubusercontent.com/pattern-ai-labs/agentcall/main/.claude-plugin
The URL at scripts/python/check_update.py:24 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
parser.add_argument("--api-url", default="https://api.agentcall.dev")
The URL at scripts/python/join.py:37 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Python environment access
api_key = os.environ.get("AGENTCALL_API_KEY", "")
The code at scripts/python/join.py:43 reads AgentCall API URL or API key values from environment variables or config. This is expected but security relevant credential handling.
Low
HTTP/HTTPS request
if msg_type == "http.request":
The hit at scripts/python/tunnel.py:60 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
HTTP client library
asyncio.create_task(self._handle_http_request(msg))
The hit at scripts/python/tunnel.py:61 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
HTTP client library
async def _handle_http_request(self, msg: dict):
The hit at scripts/python/tunnel.py:87 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
HTTP client library
async with session.request(method, local_url, headers=headers,
The hit at scripts/python/tunnel.py:100 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Hardcoded URL
- Register at https://app.agentcall.dev/login (Google OAuth)
The URL at SKILL.md:45 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
- Get API key at https://app.agentcall.dev/api-keys
The URL at SKILL.md:46 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
- Add credits at https://app.agentcall.dev/add-credits (base plan includes 360 minutes)
The URL at SKILL.md:47 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
see real-world examples at https://www.youtube.com/@pattern-ai-labs.
The URL at SKILL.md:90 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
| `--max-duration` | plan limit | Max call duration in minutes. Cannot exceed your plan's limit. Che
The URL at SKILL.md:135 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
| `--api-url` | `https://api.agentcall.dev` | Override API URL for development |
The URL at SKILL.md:138 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
If your webpage is publicly hosted, pass `--webpage-url https://your-site.com/bot`
The URL at SKILL.md:170 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
- `screenshare.start` with `url` — share a public URL: `{"command": "screenshare.start", "url": "htt
The URL at SKILL.md:208 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
- `screenshare.swap` — atomically swap to a different page: `{"command": "screenshare.swap", "port":
The URL at SKILL.md:211 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
upgrade at https://app.agentcall.dev/add-credits ($29/mo subscription or recharge $50+ for 30 days o
The URL at SKILL.md:596 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
https://app.agentcall.dev/add-credits. **Credits low does NOT terminate the call** — the call
The URL at SKILL.md:601 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"type": "screenshare.started", "url": "https://..."}
The URL at SKILL.md:666 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"type": "screenshare.start", "url": "https://your-slides.com"}
The URL at SKILL.md:782 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"type": "screenshare.swap", "url": "https://different-page.com"}
The URL at SKILL.md:784 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python scripts/python/bridge.py "https://meet.google.com/abc" --name "Claude" --voice af_heart
The URL at SKILL.md:927 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python scripts/python/bridge-visual.py "https://meet.google.com/abc" --name "Claude"
The URL at SKILL.md:933 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python scripts/python/bridge-visual.py "https://meet.google.com/abc" --screenshare-port 3001
The URL at SKILL.md:936 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python scripts/python/bridge-visual.py "https://meet.google.com/abc" \
The URL at SKILL.md:939 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
--webpage-url "https://your-site.com/avatar" \
The URL at SKILL.md:940 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
--screenshare-url "https://your-site.com/slides"
The URL at SKILL.md:941 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
- Agent can screenshare public URLs: `{"command": "screenshare.start", "url": "https://..."}`
The URL at SKILL.md:946 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
Agent: {"command": "screenshare.start", "url": "https://my-dashboard.com/slides"}
The URL at SKILL.md:966 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"event": "webpage.opened", "url": "https://xyz.conn.agentcall.dev/k/{accessKey}/webpage/"}
The URL at SKILL.md:1019 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
→ Receives: {"event": "webpage.opened", "url": "https://xyz.conn.agentcall.dev/k/.../webpage/"}
The URL at SKILL.md:1031 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"command": "send_chat", "message": "Here's the report: https://xyz.conn.agentcall.dev/k/.../webpage
The URL at SKILL.md:1034 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
- **Before `screenshare.start` (local port):** run `curl http://localhost:PORT/` and verify the resp
The URL at SKILL.md:1150 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
- **After the `screenshare.started` event arrives:** the event includes the tunnel `url`. Run `curl
The URL at SKILL.md:1151 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
{"command": "send_chat", "message": "https://github.com/org/repo/pull/42"}
The URL at SKILL.md:1239 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"https://api.agentcall.dev/v1/calls/$CALL_ID" | jq -r .status)
The URL at SKILL.md:1287 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"https://api.agentcall.dev/v1/calls/$CALL_ID" \
The URL at SKILL.md:1291 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"https://api.agentcall.dev/v1/calls/$CALL_ID"
The URL at SKILL.md:1296 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
Agent sends: {"command": "send_chat", "message": "https://github.com/org/repo/pull/42"}
The URL at SKILL.md:1353 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
| Claude Code / Agent SDK | `bash("python scripts/python/bridge.py 'https://meet.google.com/abc' --n
The URL at SKILL.md:1407 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
| OpenAI Codex | `!python scripts/python/bridge.py "https://meet.google.com/abc" --name Codex` |
The URL at SKILL.md:1408 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
- **Git Bash** (ships with [Git for Windows](https://git-scm.com/download/win)): all commands above
The URL at SKILL.md:1500 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python scripts/python/bridge.py "https://meet.google.com/abc" --name Agent \
The URL at SKILL.md:1585 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
python scripts/python/bridge.py "https://meet.google.com/abc" --name Agent \
The URL at SKILL.md:1600 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
curl https://api.agentcall.dev/v1/calls/{call_id}/transcript?format=json \
The URL at SKILL.md:1780 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
| Max duration | Plan limit (check https://agentcall.dev for current limits) |
The URL at SKILL.md:1792 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
Check https://agentcall.dev for current rates and plan limits.
The URL at SKILL.md:1807 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"repo_url": "https://github.com/pattern-ai-labs/agentcall",
The URL at SKILL.md:1833 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Hardcoded URL
"zip": "Download the latest release from https://github.com/pattern-ai-labs/agentcall"
The URL at SKILL.md:1837 documents or configures external AgentCall, meeting, tunnel, or demo endpoints. This is expected for the skill, but it is still an external network dependency.
Low
Fetch API call
const r = await fetch('tasks.json', { cache: 'no-store' });
The hit at ui-templates/avatar/index.html:227 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Fetch API call
const r = await fetch('tasks.json', { cache: 'no-store' });
The hit at ui-templates/orb/index.html:150 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Fetch API call
const r = await fetch('tasks.json', { cache: 'no-store' });
The hit at ui-templates/pattern/index.html:346 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Low
Fetch API call
const r = await fetch('tasks.json', { cache: 'no-store' });
The hit at ui-templates/ring/index.html:206 is real HTTP client usage for creating calls, deleting calls, update checks, or tunnel proxying. Meeting data or credentials may leave the local machine.
Risk Factors
🌐 Network access (265)
examples/coding-companion/bridge.py:40 examples/coding-companion/bridge.py:46 examples/coding-companion/bridge.py:49 examples/coding-companion/bridge.py:99 examples/coding-companion/README.md:70 examples/coding-companion/README.md:23 examples/coding-companion/README.md:30 examples/coding-companion/README.md:149 examples/coding-companion/README.md:155 examples/coding-companion/README.md:192 examples/coding-companion/README.md:195 examples/coding-companion/README.md:198 examples/coding-companion/README.md:225 examples/coding-companion/SKILL-FRAGMENT.md:31 examples/coding-companion/SKILL-FRAGMENT.md:83 examples/coding-companion/SKILL-FRAGMENT.md:90 examples/meeting-assistant-smart/assistant.py:303 examples/meeting-assistant-smart/assistant.py:511 examples/meeting-assistant-smart/assistant.py:569 examples/meeting-assistant-smart/assistant.py:29 examples/meeting-assistant-smart/assistant.py:56 examples/meeting-assistant-smart/assistant.py:525 examples/meeting-assistant-smart/assistant.py:526 examples/meeting-assistant-smart/assistant.py:527 examples/meeting-assistant-smart/README.md:148 examples/meeting-assistant-smart/README.md:155 examples/meeting-assistant-smart/README.md:158 examples/meeting-assistant-smart/README.md:161 examples/meeting-assistant-smart/tools.py:50 examples/meeting-assistant/assistant.py:56 examples/meeting-assistant/assistant.py:200 examples/meeting-assistant/assistant.py:256 examples/meeting-assistant/assistant.py:16 examples/meeting-assistant/assistant.py:19 examples/meeting-assistant/assistant.py:44 examples/meeting-assistant/assistant.py:216 examples/meeting-assistant/assistant.py:219 examples/meeting-assistant/assistant.py:222 examples/meeting-assistant/README.md:34 examples/meeting-assistant/README.md:41 examples/meeting-assistant/README.md:44 examples/meeting-assistant/README.md:47 examples/meeting-assistant/README.md:50 examples/meeting-assistant/README.md:53 examples/notetaker-multilingual/notetaker.py:198 examples/notetaker-multilingual/notetaker.py:304 examples/notetaker-multilingual/notetaker.py:388 examples/notetaker-multilingual/notetaker.py:16 examples/notetaker-multilingual/notetaker.py:19 examples/notetaker-multilingual/notetaker.py:22 examples/notetaker-multilingual/notetaker.py:58 examples/notetaker-multilingual/notetaker.py:351 examples/notetaker-multilingual/notetaker.py:354 examples/notetaker-multilingual/notetaker.py:357 examples/notetaker-multilingual/notetaker.py:360 examples/notetaker-multilingual/README.md:37 examples/notetaker-multilingual/README.md:41 examples/notetaker-multilingual/README.md:44 examples/notetaker-multilingual/README.md:47 examples/notetaker-multilingual/README.md:50 examples/notetaker-simple/notetaker.js:54 examples/notetaker-simple/notetaker.js:73 examples/notetaker-simple/notetaker.js:211 examples/notetaker-simple/notetaker.js:124 examples/notetaker-simple/notetaker.js:10 examples/notetaker-simple/notetaker.js:13 examples/notetaker-simple/notetaker.js:29 examples/notetaker-simple/notetaker.py:47 examples/notetaker-simple/notetaker.py:64 examples/notetaker-simple/notetaker.py:159 examples/notetaker-simple/notetaker.py:207 examples/notetaker-simple/notetaker.py:10 examples/notetaker-simple/notetaker.py:13 examples/notetaker-simple/notetaker.py:35 examples/notetaker-simple/README.md:26 examples/notetaker-simple/README.md:34 examples/notetaker-simple/README.md:41 examples/notetaker-simple/README.md:42 examples/notetaker-smart/notetaker.js:175 examples/notetaker-smart/notetaker.js:191 examples/notetaker-smart/notetaker.js:350 examples/notetaker-smart/notetaker.js:261 examples/notetaker-smart/notetaker.js:10 examples/notetaker-smart/notetaker.js:13 examples/notetaker-smart/notetaker.js:34 examples/notetaker-smart/notetaker.js:155 examples/notetaker-smart/notetaker.py:164 examples/notetaker-smart/notetaker.py:180 examples/notetaker-smart/notetaker.py:289 examples/notetaker-smart/notetaker.py:339 examples/notetaker-smart/notetaker.py:10 examples/notetaker-smart/notetaker.py:13 examples/notetaker-smart/notetaker.py:35 examples/notetaker-smart/notetaker.py:146 examples/notetaker-smart/README.md:37 examples/notetaker-smart/README.md:49 examples/notetaker-smart/README.md:56 examples/notetaker-smart/README.md:59 examples/support-agent/agent.py:235 examples/support-agent/agent.py:12 examples/support-agent/agent.py:15 examples/support-agent/agent.py:50 examples/support-agent/agent.py:211 examples/support-agent/agent.py:417 examples/support-agent/agent.py:418 examples/support-agent/agent.py:419 examples/support-agent/README.md:51 examples/support-agent/README.md:58 examples/support-agent/README.md:61 examples/support-agent/README.md:64 README.md:70 README.md:78 references/api.md:12 references/api.md:18 references/api.md:24 references/api.md:32 references/api.md:47 references/api.md:59 references/api.md:70 references/api.md:71 references/api.md:81 references/api.md:99 references/api.md:116 references/guides/collaborative-mode.md:32 references/guides/collaborative-mode.md:395 references/guides/crash-recovery.md:135 references/guides/crash-recovery.md:177 references/guides/interruption-handling.md:125 references/guides/webpage-audio.md:132 references/guides/webpage-audio.md:157 references/guides/webpage-audio.md:341 references/guides/webpage-av-screenshare.md:121 references/guides/webpage-av-screenshare.md:33 references/guides/webpage-av-screenshare.md:39 references/guides/webpage-av-screenshare.md:41 references/guides/webpage-av-screenshare.md:45 references/guides/webpage-av-screenshare.md:47 references/guides/webpage-av-screenshare.md:48 references/guides/webpage-av-screenshare.md:152 references/guides/webpage-av-screenshare.md:192 references/guides/webpage-av.md:63 references/guides/webpage-av.md:23 references/guides/webpage-av.md:100 references/guides/webpage-av.md:102 scripts/node/agentcall.js:39 scripts/node/agentcall.js:76 scripts/node/agentcall.js:25 scripts/node/bridge-visual.js:688 scripts/node/bridge-visual.js:594 scripts/node/bridge-visual.js:576 scripts/node/bridge-visual.js:723 scripts/node/bridge-visual.js:835 scripts/node/bridge-visual.js:22 scripts/node/bridge-visual.js:25 scripts/node/bridge-visual.js:31 scripts/node/bridge-visual.js:32 scripts/node/bridge-visual.js:33 scripts/node/bridge-visual.js:53 scripts/node/bridge-visual.js:125 scripts/node/bridge-visual.js:64 scripts/node/bridge-visual.js:549 scripts/node/bridge.js:352 scripts/node/bridge.js:387 scripts/node/bridge.js:444 scripts/node/bridge.js:25 scripts/node/bridge.js:28 scripts/node/bridge.js:50 scripts/node/check_update.js:109 scripts/node/check_update.js:24 scripts/node/check_update.js:25 scripts/node/join.js:28 scripts/node/tunnel.js:58 scripts/node/tunnel.js:79 scripts/node/tunnel.js:79 scripts/node/tunnel.js:21 scripts/python/agentcall.py:48 scripts/python/bridge-visual.py:779 scripts/python/bridge-visual.py:801 scripts/python/bridge-visual.py:24 scripts/python/bridge-visual.py:29 scripts/python/bridge-visual.py:32 scripts/python/bridge-visual.py:39 scripts/python/bridge-visual.py:42 scripts/python/bridge-visual.py:45 scripts/python/bridge-visual.py:73 scripts/python/bridge-visual.py:191 scripts/python/bridge-visual.py:765 scripts/python/bridge-visual.py:768 scripts/python/bridge-visual.py:771 scripts/python/bridge-visual.py:772 scripts/python/bridge-visual.py:1034 scripts/python/bridge-visual.py:1603 scripts/python/bridge-visual.py:1606 scripts/python/bridge-visual.py:1609 scripts/python/bridge-visual.py:1612 scripts/python/bridge-visual.py:716 scripts/python/bridge-visual.py:1042 scripts/python/bridge-visual.py:1088 scripts/python/bridge.py:42 scripts/python/bridge.py:48 scripts/python/bridge.py:51 scripts/python/bridge.py:132 scripts/python/check_update.py:18 scripts/python/check_update.py:105 scripts/python/check_update.py:109 scripts/python/check_update.py:23 scripts/python/check_update.py:24 scripts/python/join.py:37 scripts/python/tunnel.py:60 scripts/python/tunnel.py:61 scripts/python/tunnel.py:87 scripts/python/tunnel.py:100 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:90 SKILL.md:135 SKILL.md:138 SKILL.md:170 SKILL.md:208 SKILL.md:211 SKILL.md:596 SKILL.md:601 SKILL.md:666 SKILL.md:782 SKILL.md:784 SKILL.md:927 SKILL.md:933 SKILL.md:936 SKILL.md:939 SKILL.md:940 SKILL.md:941 SKILL.md:946 SKILL.md:966 SKILL.md:1019 SKILL.md:1031 SKILL.md:1034 SKILL.md:1150 SKILL.md:1151 SKILL.md:1239 SKILL.md:1287 SKILL.md:1291 SKILL.md:1296 SKILL.md:1353 SKILL.md:1407 SKILL.md:1408 SKILL.md:1500 SKILL.md:1585 SKILL.md:1600 SKILL.md:1780 SKILL.md:1792 SKILL.md:1807 SKILL.md:1833 SKILL.md:1837 ui-templates/avatar/index.html:227 ui-templates/avatar/index.html:201 ui-templates/blank/index.html:31 ui-templates/dashboard/index.html:69 ui-templates/orb/index.html:150 ui-templates/orb/index.html:125 ui-templates/pattern/index.html:346 ui-templates/pattern/index.html:300 ui-templates/ring/index.html:206 ui-templates/ring/index.html:178 ui-templates/voice-agent/index.html:189
📁 Filesystem access (178)
examples/coding-companion/bridge.py:103 examples/coding-companion/bridge.py:103 examples/coding-companion/README.md:111 examples/coding-companion/README.md:131 examples/coding-companion/README.md:132 examples/coding-companion/README.md:131 examples/coding-companion/README.md:132 examples/coding-companion/README.md:152 examples/coding-companion/SKILL-FRAGMENT.md:35 examples/coding-companion/SKILL-FRAGMENT.md:39 examples/coding-companion/SKILL-FRAGMENT.md:35 examples/coding-companion/SKILL-FRAGMENT.md:39 examples/coding-companion/SKILL-FRAGMENT.md:168 examples/meeting-assistant-smart/assistant.py:418 examples/meeting-assistant-smart/assistant.py:60 examples/meeting-assistant-smart/assistant.py:60 examples/meeting-assistant-smart/assistant.py:338 examples/meeting-assistant/assistant.py:129 examples/meeting-assistant/assistant.py:48 examples/meeting-assistant/assistant.py:48 examples/meeting-assistant/assistant.py:84 examples/meeting-assistant/README.md:177 examples/notetaker-multilingual/notetaker.py:258 examples/notetaker-multilingual/notetaker.py:265 examples/notetaker-multilingual/notetaker.py:63 examples/notetaker-multilingual/notetaker.py:63 examples/notetaker-multilingual/notetaker.py:158 examples/notetaker-multilingual/notetaker.py:168 examples/notetaker-multilingual/notetaker.py:226 examples/notetaker-simple/notetaker.js:26 examples/notetaker-simple/notetaker.js:107 examples/notetaker-simple/notetaker.js:25 examples/notetaker-simple/notetaker.js:26 examples/notetaker-simple/notetaker.js:107 examples/notetaker-simple/notetaker.js:127 examples/notetaker-simple/notetaker.js:135 examples/notetaker-simple/notetaker.js:33 examples/notetaker-simple/notetaker.js:33 examples/notetaker-simple/notetaker.py:121 examples/notetaker-simple/notetaker.py:128 examples/notetaker-simple/notetaker.py:39 examples/notetaker-simple/notetaker.py:39 examples/notetaker-simple/notetaker.py:78 examples/notetaker-smart/notetaker.js:31 examples/notetaker-smart/notetaker.js:245 examples/notetaker-smart/notetaker.js:30 examples/notetaker-smart/notetaker.js:31 examples/notetaker-smart/notetaker.js:245 examples/notetaker-smart/notetaker.js:263 examples/notetaker-smart/notetaker.js:270 examples/notetaker-smart/notetaker.js:38 examples/notetaker-smart/notetaker.js:38 examples/notetaker-smart/notetaker.py:256 examples/notetaker-smart/notetaker.py:263 examples/notetaker-smart/notetaker.py:39 examples/notetaker-smart/notetaker.py:39 examples/notetaker-smart/notetaker.py:208 examples/support-agent/agent.py:309 examples/support-agent/agent.py:54 examples/support-agent/agent.py:54 examples/support-agent/agent.py:255 README.md:65 README.md:84 README.md:124 README.md:65 README.md:84 README.md:124 references/api.md:80 references/api.md:81 references/api.md:103 references/guides/webpage-audio.md:128 references/guides/webpage-audio.md:148 references/guides/webpage-audio.md:322 references/guides/webpage-av-screenshare.md:61 references/guides/webpage-av-screenshare.md:88 references/guides/webpage-av-screenshare.md:136 references/guides/webpage-av-screenshare.md:140 references/guides/webpage-av-screenshare.md:168 references/guides/webpage-av-screenshare.md:171 references/guides/webpage-av-screenshare.md:174 references/guides/webpage-av-screenshare.md:210 references/guides/webpage-av-screenshare.md:217 references/guides/webpage-av-screenshare.md:220 references/guides/webpage-av-screenshare.md:224 references/guides/webpage-av-screenshare.md:239 references/guides/webpage-av.md:20 references/guides/webpage-av.md:55 references/guides/webpage-av.md:56 scripts/node/agentcall.js:5 scripts/node/agentcall.js:15 scripts/node/bridge-visual.js:39 scripts/node/bridge-visual.js:122 scripts/node/bridge-visual.js:214 scripts/node/bridge-visual.js:510 scripts/node/bridge-visual.js:545 scripts/node/bridge-visual.js:507 scripts/node/bridge-visual.js:129 scripts/node/bridge-visual.js:129 scripts/node/bridge.js:34 scripts/node/bridge.js:47 scripts/node/bridge.js:125 scripts/node/bridge.js:54 scripts/node/bridge.js:54 scripts/node/check_update.js:16 scripts/node/check_update.js:47 scripts/node/check_update.js:80 scripts/node/check_update.js:90 scripts/node/check_update.js:9 scripts/node/check_update.js:11 scripts/node/check_update.js:9 scripts/node/check_update.js:11 scripts/node/check_update.js:25 scripts/node/join.js:9 scripts/node/join.js:64 scripts/node/join.js:80 scripts/python/agentcall.py:16 scripts/python/agentcall.py:30 scripts/python/agentcall.py:16 scripts/python/agentcall.py:30 scripts/python/bridge-visual.py:694 scripts/python/bridge-visual.py:692 scripts/python/bridge-visual.py:705 scripts/python/bridge-visual.py:706 scripts/python/bridge-visual.py:1245 scripts/python/bridge-visual.py:195 scripts/python/bridge-visual.py:195 scripts/python/bridge-visual.py:148 scripts/python/bridge.py:136 scripts/python/bridge.py:136 scripts/python/bridge.py:89 scripts/python/check_update.py:8 scripts/python/check_update.py:10 scripts/python/check_update.py:8 scripts/python/check_update.py:10 scripts/python/check_update.py:24 scripts/run.sh:5 scripts/run.sh:7 SKILL.md:1031 SKILL.md:1034 SKILL.md:42 SKILL.md:50 SKILL.md:51 SKILL.md:57 SKILL.md:69 SKILL.md:72 SKILL.md:92 SKILL.md:273 SKILL.md:1847 SKILL.md:42 SKILL.md:50 SKILL.md:51 SKILL.md:57 SKILL.md:69 SKILL.md:72 SKILL.md:92 SKILL.md:273 SKILL.md:1847 SKILL.md:1550 SKILL.md:1593 SKILL.md:1278 SKILL.md:235 SKILL.md:236 SKILL.md:240 SKILL.md:244 SKILL.md:971 SKILL.md:1027 SKILL.md:1275 SKILL.md:1586 SKILL.md:1590 SKILL.md:1599 SKILL.md:1601 SKILL.md:1604 SKILL.md:1611 SKILL.md:1623 SKILL.md:1627 SKILL.md:1692 SKILL.md:1704 SKILL.md:1428
🔑 Env variables (193)
examples/coding-companion/bridge.py:99 examples/coding-companion/bridge.py:100 examples/coding-companion/bridge.py:45 examples/coding-companion/bridge.py:100 examples/coding-companion/bridge.py:102 examples/coding-companion/bridge.py:103 examples/coding-companion/bridge.py:201 examples/coding-companion/bridge.py:221 examples/coding-companion/README.md:123 examples/coding-companion/SKILL-FRAGMENT.md:36 examples/coding-companion/SKILL-FRAGMENT.md:39 examples/meeting-assistant-smart/assistant.py:56 examples/meeting-assistant-smart/assistant.py:57 examples/meeting-assistant-smart/assistant.py:209 examples/meeting-assistant-smart/assistant.py:28 examples/meeting-assistant-smart/assistant.py:57 examples/meeting-assistant-smart/assistant.py:59 examples/meeting-assistant-smart/assistant.py:60 examples/meeting-assistant-smart/assistant.py:63 examples/meeting-assistant-smart/assistant.py:175 examples/meeting-assistant-smart/assistant.py:191 examples/meeting-assistant-smart/assistant.py:209 examples/meeting-assistant-smart/README.md:145 examples/meeting-assistant-smart/README.md:146 examples/meeting-assistant/assistant.py:44 examples/meeting-assistant/assistant.py:45 examples/meeting-assistant/assistant.py:15 examples/meeting-assistant/assistant.py:45 examples/meeting-assistant/assistant.py:47 examples/meeting-assistant/assistant.py:48 examples/meeting-assistant/assistant.py:51 examples/meeting-assistant/README.md:33 examples/notetaker-multilingual/notetaker.py:58 examples/notetaker-multilingual/notetaker.py:59 examples/notetaker-multilingual/notetaker.py:60 examples/notetaker-multilingual/notetaker.py:14 examples/notetaker-multilingual/notetaker.py:15 examples/notetaker-multilingual/notetaker.py:59 examples/notetaker-multilingual/notetaker.py:60 examples/notetaker-multilingual/notetaker.py:62 examples/notetaker-multilingual/notetaker.py:63 examples/notetaker-multilingual/notetaker.py:66 examples/notetaker-multilingual/notetaker.py:67 examples/notetaker-multilingual/notetaker.py:70 examples/notetaker-multilingual/notetaker.py:181 examples/notetaker-multilingual/README.md:29 examples/notetaker-multilingual/README.md:30 examples/notetaker-simple/notetaker.js:29 examples/notetaker-simple/notetaker.js:30 examples/notetaker-simple/notetaker.js:29 examples/notetaker-simple/notetaker.js:30 examples/notetaker-simple/notetaker.js:9 examples/notetaker-simple/notetaker.js:30 examples/notetaker-simple/notetaker.js:32 examples/notetaker-simple/notetaker.js:33 examples/notetaker-simple/notetaker.js:38 examples/notetaker-simple/notetaker.py:35 examples/notetaker-simple/notetaker.py:36 examples/notetaker-simple/notetaker.py:9 examples/notetaker-simple/notetaker.py:36 examples/notetaker-simple/notetaker.py:38 examples/notetaker-simple/notetaker.py:39 examples/notetaker-simple/notetaker.py:42 examples/notetaker-simple/README.md:25 examples/notetaker-simple/README.md:33 examples/notetaker-smart/notetaker.js:34 examples/notetaker-smart/notetaker.js:35 examples/notetaker-smart/notetaker.js:143 examples/notetaker-smart/notetaker.js:34 examples/notetaker-smart/notetaker.js:35 examples/notetaker-smart/notetaker.js:143 examples/notetaker-smart/notetaker.js:9 examples/notetaker-smart/notetaker.js:35 examples/notetaker-smart/notetaker.js:37 examples/notetaker-smart/notetaker.js:38 examples/notetaker-smart/notetaker.js:43 examples/notetaker-smart/notetaker.js:111 examples/notetaker-smart/notetaker.js:126 examples/notetaker-smart/notetaker.js:140 examples/notetaker-smart/notetaker.js:143 examples/notetaker-smart/notetaker.py:35 examples/notetaker-smart/notetaker.py:36 examples/notetaker-smart/notetaker.py:133 examples/notetaker-smart/notetaker.py:9 examples/notetaker-smart/notetaker.py:36 examples/notetaker-smart/notetaker.py:38 examples/notetaker-smart/notetaker.py:39 examples/notetaker-smart/notetaker.py:42 examples/notetaker-smart/notetaker.py:98 examples/notetaker-smart/notetaker.py:102 examples/notetaker-smart/notetaker.py:114 examples/notetaker-smart/notetaker.py:118 examples/notetaker-smart/notetaker.py:129 examples/notetaker-smart/notetaker.py:133 examples/notetaker-smart/notetaker.py:147 examples/notetaker-smart/README.md:34 examples/notetaker-smart/README.md:35 examples/notetaker-smart/README.md:46 examples/notetaker-smart/README.md:47 examples/support-agent/agent.py:50 examples/support-agent/agent.py:51 examples/support-agent/agent.py:195 examples/support-agent/agent.py:11 examples/support-agent/agent.py:51 examples/support-agent/agent.py:53 examples/support-agent/agent.py:54 examples/support-agent/agent.py:57 examples/support-agent/agent.py:156 examples/support-agent/agent.py:175 examples/support-agent/agent.py:191 examples/support-agent/agent.py:195 examples/support-agent/agent.py:211 examples/support-agent/README.md:48 examples/support-agent/README.md:49 references/api.md:37 references/api.md:187 references/guides/collaborative-mode.md:392 references/guides/crash-recovery.md:155 scripts/node/agentcall.js:24 scripts/node/agentcall.js:25 scripts/node/agentcall.js:24 scripts/node/agentcall.js:25 scripts/node/agentcall.js:24 scripts/node/agentcall.js:73 scripts/node/bridge-visual.js:125 scripts/node/bridge-visual.js:126 scripts/node/bridge-visual.js:125 scripts/node/bridge-visual.js:126 scripts/node/bridge-visual.js:30 scripts/node/bridge-visual.js:126 scripts/node/bridge-visual.js:128 scripts/node/bridge-visual.js:129 scripts/node/bridge-visual.js:685 scripts/node/bridge-visual.js:713 scripts/node/bridge-visual.js:832 scripts/node/bridge.js:50 scripts/node/bridge.js:51 scripts/node/bridge.js:50 scripts/node/bridge.js:51 scripts/node/bridge.js:24 scripts/node/bridge.js:51 scripts/node/bridge.js:53 scripts/node/bridge.js:54 scripts/node/bridge.js:347 scripts/node/bridge.js:377 scripts/node/bridge.js:441 scripts/node/join.js:94 scripts/node/join.js:94 scripts/node/join.js:94 scripts/node/join.js:96 scripts/python/agentcall.py:17 scripts/python/agentcall.py:31 scripts/python/agentcall.py:15 scripts/python/agentcall.py:17 scripts/python/agentcall.py:23 scripts/python/agentcall.py:46 scripts/python/agentcall.py:47 scripts/python/agentcall.py:54 scripts/python/agentcall.py:107 scripts/python/bridge-visual.py:191 scripts/python/bridge-visual.py:192 scripts/python/bridge-visual.py:191 scripts/python/bridge-visual.py:192 scripts/python/bridge-visual.py:36 scripts/python/bridge-visual.py:192 scripts/python/bridge-visual.py:194 scripts/python/bridge-visual.py:195 scripts/python/bridge-visual.py:523 scripts/python/bridge-visual.py:563 scripts/python/bridge.py:132 scripts/python/bridge.py:133 scripts/python/bridge.py:132 scripts/python/bridge.py:133 scripts/python/bridge.py:47 scripts/python/bridge.py:133 scripts/python/bridge.py:135 scripts/python/bridge.py:136 scripts/python/bridge.py:402 scripts/python/bridge.py:431 scripts/python/join.py:43 scripts/python/join.py:43 scripts/python/join.py:44 scripts/python/join.py:45 scripts/python/join.py:48 scripts/python/tunnel.py:5 SKILL.md:42 SKILL.md:43 SKILL.md:52 SKILL.md:57 SKILL.md:96 SKILL.md:1286 SKILL.md:1290 SKILL.md:1295
⚡ Contains scripts (5)
⚙️ External commands (578)
examples/notetaker-simple/notetaker.js:38 examples/notetaker-simple/notetaker.js:54 examples/notetaker-simple/notetaker.js:67 examples/notetaker-simple/notetaker.js:74 examples/notetaker-simple/notetaker.js:84 examples/notetaker-simple/notetaker.js:86 examples/notetaker-simple/notetaker.js:90 examples/notetaker-simple/notetaker.js:97 examples/notetaker-simple/notetaker.js:102 examples/notetaker-simple/notetaker.js:103 examples/notetaker-simple/notetaker.js:104 examples/notetaker-simple/notetaker.js:105 examples/notetaker-simple/notetaker.js:108 examples/notetaker-simple/notetaker.js:121 examples/notetaker-simple/notetaker.js:139 examples/notetaker-simple/notetaker.js:142 examples/notetaker-simple/notetaker.js:149 examples/notetaker-simple/notetaker.js:152 examples/notetaker-simple/notetaker.js:158 examples/notetaker-simple/notetaker.js:174 examples/notetaker-simple/notetaker.js:175 examples/notetaker-simple/notetaker.js:198 examples/notetaker-simple/notetaker.js:199 examples/notetaker-simple/notetaker.js:202 examples/notetaker-simple/notetaker.js:203 examples/notetaker-simple/notetaker.js:211 examples/notetaker-smart/notetaker.js:43 examples/notetaker-smart/notetaker.js:66-96 examples/notetaker-smart/notetaker.js:175 examples/notetaker-smart/notetaker.js:186 examples/notetaker-smart/notetaker.js:192 examples/notetaker-smart/notetaker.js:203 examples/notetaker-smart/notetaker.js:222 examples/notetaker-smart/notetaker.js:224 examples/notetaker-smart/notetaker.js:225 examples/notetaker-smart/notetaker.js:226 examples/notetaker-smart/notetaker.js:227 examples/notetaker-smart/notetaker.js:228 examples/notetaker-smart/notetaker.js:242 examples/notetaker-smart/notetaker.js:246 examples/notetaker-smart/notetaker.js:258 examples/notetaker-smart/notetaker.js:273 examples/notetaker-smart/notetaker.js:275 examples/notetaker-smart/notetaker.js:284 examples/notetaker-smart/notetaker.js:287 examples/notetaker-smart/notetaker.js:293 examples/notetaker-smart/notetaker.js:310 examples/notetaker-smart/notetaker.js:311 examples/notetaker-smart/notetaker.js:350 examples/notetaker-smart/notetaker.js:358 examples/notetaker-smart/notetaker.js:359 examples/notetaker-smart/notetaker.js:362 examples/notetaker-smart/notetaker.js:363 examples/support-agent/agent.py:269-285 scripts/node/agentcall.js:30 scripts/node/agentcall.js:34 scripts/node/agentcall.js:42 scripts/node/agentcall.js:54 scripts/node/agentcall.js:58 scripts/node/agentcall.js:66 scripts/node/agentcall.js:73 scripts/node/bridge-visual.js:84 scripts/node/bridge-visual.js:219 scripts/node/bridge-visual.js:493 scripts/node/bridge-visual.js:586 scripts/node/bridge-visual.js:597 scripts/node/bridge-visual.js:598 scripts/node/bridge-visual.js:661 scripts/node/bridge-visual.js:682 scripts/node/bridge-visual.js:685 scripts/node/bridge-visual.js:691 scripts/node/bridge-visual.js:698 scripts/node/bridge-visual.js:713 scripts/node/bridge-visual.js:715 scripts/node/bridge-visual.js:719 scripts/node/bridge-visual.js:731 scripts/node/bridge-visual.js:744 scripts/node/bridge-visual.js:757 scripts/node/bridge-visual.js:759 scripts/node/bridge-visual.js:765 scripts/node/bridge-visual.js:792 scripts/node/bridge-visual.js:801 scripts/node/bridge-visual.js:810 scripts/node/bridge-visual.js:822 scripts/node/bridge-visual.js:832 scripts/node/bridge-visual.js:837 scripts/node/bridge-visual.js:910 scripts/node/bridge-visual.js:923 scripts/node/bridge-visual.js:927 scripts/node/bridge-visual.js:1001 scripts/node/bridge-visual.js:1006 scripts/node/bridge-visual.js:1040 scripts/node/bridge-visual.js:1055 scripts/node/bridge-visual.js:1068 scripts/node/bridge-visual.js:1110 scripts/node/bridge-visual.js:1122 scripts/node/bridge-visual.js:1127 scripts/node/bridge-visual.js:1190 scripts/node/bridge-visual.js:1237 scripts/node/bridge-visual.js:1240 scripts/node/bridge-visual.js:1244 scripts/node/bridge-visual.js:1267 scripts/node/bridge-visual.js:1284 scripts/node/bridge.js:130 scripts/node/bridge.js:343 scripts/node/bridge.js:347 scripts/node/bridge.js:355 scripts/node/bridge.js:362 scripts/node/bridge.js:377 scripts/node/bridge.js:379 scripts/node/bridge.js:383 scripts/node/bridge.js:395 scripts/node/bridge.js:408 scripts/node/bridge.js:411 scripts/node/bridge.js:431 scripts/node/bridge.js:441 scripts/node/bridge.js:446 scripts/node/bridge.js:510 scripts/node/bridge.js:523 scripts/node/bridge.js:527 scripts/node/bridge.js:593 scripts/node/bridge.js:605 scripts/node/bridge.js:610 scripts/node/bridge.js:689 scripts/node/bridge.js:692 scripts/node/bridge.js:696 scripts/node/bridge.js:720 scripts/node/bridge.js:738 scripts/node/check_update.js:33 scripts/node/check_update.js:120 scripts/node/join.js:109 scripts/node/join.js:172 scripts/node/tunnel.js:32 scripts/node/tunnel.js:108 scripts/node/tunnel.js:127 scripts/python/bridge-visual.py:1514 scripts/run.sh:3 scripts/run.sh:1 SKILL.md:23 SKILL.md:27 SKILL.md:34 SKILL.md:35 SKILL.md:42 SKILL.md:43 SKILL.md:49-54 SKILL.md:54-57 SKILL.md:57 SKILL.md:69 SKILL.md:72 SKILL.md:74-75 SKILL.md:75-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86-87 SKILL.md:87-92 SKILL.md:92-94 SKILL.md:94-102 SKILL.md:102-116 SKILL.md:116-118 SKILL.md:118-124 SKILL.md:124 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:128 SKILL.md:129 SKILL.md:130 SKILL.md:131 SKILL.md:132-133 SKILL.md:133-134 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-137 SKILL.md:137-138 SKILL.md:138 SKILL.md:150-154 SKILL.md:154-168 SKILL.md:168-170 SKILL.md:170-171 SKILL.md:171-187 SKILL.md:187 SKILL.md:189-194 SKILL.md:194-197 SKILL.md:197-198 SKILL.md:198-208 SKILL.md:208 SKILL.md:209 SKILL.md:210 SKILL.md:211 SKILL.md:213 SKILL.md:214-227 SKILL.md:227-228 SKILL.md:228 SKILL.md:229-230 SKILL.md:230-231 SKILL.md:231-233 SKILL.md:233-246 SKILL.md:246-254 SKILL.md:254-267 SKILL.md:267-268 SKILL.md:268-269 SKILL.md:269-270 SKILL.md:270-272 SKILL.md:272-273 SKILL.md:273 SKILL.md:275-276 SKILL.md:276 SKILL.md:277-279 SKILL.md:279-282 SKILL.md:282 SKILL.md:292-298 SKILL.md:298-299 SKILL.md:299-301 SKILL.md:301 SKILL.md:305-306 SKILL.md:306-307 SKILL.md:307-308 SKILL.md:308-310 SKILL.md:310 SKILL.md:312 SKILL.md:321-324 SKILL.md:324-330 SKILL.md:330-349 SKILL.md:349-352 SKILL.md:352 SKILL.md:353 SKILL.md:354 SKILL.md:355 SKILL.md:356 SKILL.md:358-362 SKILL.md:362-363 SKILL.md:363-368 SKILL.md:368-369 SKILL.md:369-383 SKILL.md:383 SKILL.md:387-398 SKILL.md:398-406 SKILL.md:406-414 SKILL.md:414-421 SKILL.md:421-422 SKILL.md:422-423 SKILL.md:423-429 SKILL.md:429-433 SKILL.md:433-440 SKILL.md:440-441 SKILL.md:441-453 SKILL.md:453-458 SKILL.md:458-466 SKILL.md:466-473 SKILL.md:473-474 SKILL.md:474-475 SKILL.md:475-478 SKILL.md:478-479 SKILL.md:479-498 SKILL.md:498 SKILL.md:499 SKILL.md:500-502 SKILL.md:502 SKILL.md:505-513 SKILL.md:513-514 SKILL.md:514-516 SKILL.md:516-518 SKILL.md:518-523 SKILL.md:523-528 SKILL.md:528-530 SKILL.md:530-537 SKILL.md:537-538 SKILL.md:538-539 SKILL.md:539-543 SKILL.md:543-547 SKILL.md:547 SKILL.md:554-558 SKILL.md:558 SKILL.md:565 SKILL.md:567 SKILL.md:570-586 SKILL.md:586-588 SKILL.md:588 SKILL.md:590-598 SKILL.md:598-599 SKILL.md:599 SKILL.md:604 SKILL.md:606-607 SKILL.md:607-609 SKILL.md:609 SKILL.md:612-615 SKILL.md:615-616 SKILL.md:616 SKILL.md:619-624 SKILL.md:624-627 SKILL.md:627-630 SKILL.md:630-635 SKILL.md:635-636 SKILL.md:636-637 SKILL.md:637-638 SKILL.md:638-639 SKILL.md:639-640 SKILL.md:640-641 SKILL.md:641-643 SKILL.md:643-646 SKILL.md:646-653 SKILL.md:653-654 SKILL.md:654-655 SKILL.md:655 SKILL.md:656 SKILL.md:657 SKILL.md:660-669 SKILL.md:669-670 SKILL.md:670 SKILL.md:673-676 SKILL.md:676-683 SKILL.md:683-689 SKILL.md:689-699 SKILL.md:699-711 SKILL.md:711-715 SKILL.md:715-718 SKILL.md:718-722 SKILL.md:722-726 SKILL.md:726 SKILL.md:727-731 SKILL.md:731-734 SKILL.md:734-735 SKILL.md:735 SKILL.md:736-738 SKILL.md:738-739 SKILL.md:739-741 SKILL.md:741-745 SKILL.md:745-746 SKILL.md:746 SKILL.md:749 SKILL.md:751-753 SKILL.md:753-755 SKILL.md:755-757 SKILL.md:757-758 SKILL.md:758-759 SKILL.md:759-761 SKILL.md:761-762 SKILL.md:762-763 SKILL.md:763 SKILL.md:764 SKILL.md:765-768 SKILL.md:768-771 SKILL.md:771-774 SKILL.md:774-789 SKILL.md:789-790 SKILL.md:790 SKILL.md:792-799 SKILL.md:799-800 SKILL.md:800-822 SKILL.md:822-824 SKILL.md:824-826 SKILL.md:826-834 SKILL.md:834 SKILL.md:835-838 SKILL.md:838-841 SKILL.md:841-846 SKILL.md:846-867 SKILL.md:867-871 SKILL.md:871-884 SKILL.md:884-888 SKILL.md:888-894 SKILL.md:894-900 SKILL.md:900-905 SKILL.md:905-921 SKILL.md:921-922 SKILL.md:922-923 SKILL.md:923-926 SKILL.md:926-928 SKILL.md:928-931 SKILL.md:931-942 SKILL.md:942-946 SKILL.md:946-947 SKILL.md:947-948 SKILL.md:948 SKILL.md:949-951 SKILL.md:951 SKILL.md:957-980 SKILL.md:980-983 SKILL.md:983-988 SKILL.md:988-992 SKILL.md:992 SKILL.md:994-1012 SKILL.md:1012-1015 SKILL.md:1015-1018 SKILL.md:1018-1022 SKILL.md:1022-1025 SKILL.md:1025-1043 SKILL.md:1043-1054 SKILL.md:1054-1058 SKILL.md:1058-1059 SKILL.md:1059-1064 SKILL.md:1064-1070 SKILL.md:1070-1071 SKILL.md:1071-1072 SKILL.md:1072-1075 SKILL.md:1075-1077 SKILL.md:1077 SKILL.md:1078 SKILL.md:1084-1089 SKILL.md:1089-1094 SKILL.md:1094-1096 SKILL.md:1096-1098 SKILL.md:1098-1102 SKILL.md:1102-1105 SKILL.md:1105-1124 SKILL.md:1124-1130 SKILL.md:1130 SKILL.md:1131 SKILL.md:1132-1133 SKILL.md:1133 SKILL.md:1134-1135 SKILL.md:1135 SKILL.md:1136 SKILL.md:1141 SKILL.md:1142-1143 SKILL.md:1143 SKILL.md:1144 SKILL.md:1145-1146 SKILL.md:1146 SKILL.md:1150 SKILL.md:1151 SKILL.md:1152-1158 SKILL.md:1158-1172 SKILL.md:1172-1186 SKILL.md:1186-1187 SKILL.md:1187-1195 SKILL.md:1195-1205 SKILL.md:1205-1208 SKILL.md:1208 SKILL.md:1214-1219 SKILL.md:1219-1220 SKILL.md:1220-1223 SKILL.md:1223-1224 SKILL.md:1224-1226 SKILL.md:1226-1233 SKILL.md:1233-1236 SKILL.md:1236-1243 SKILL.md:1243-1248 SKILL.md:1248 SKILL.md:1249 SKILL.md:1250-1251 SKILL.md:1251 SKILL.md:1252 SKILL.md:1253-1257 SKILL.md:1257-1262 SKILL.md:1262-1263 SKILL.md:1263-1264 SKILL.md:1264-1272 SKILL.md:1272 SKILL.md:1274-1279 SKILL.md:1279-1283 SKILL.md:1283-1284 SKILL.md:1284-1298 SKILL.md:1298-1300 SKILL.md:1300 SKILL.md:1305-1314 SKILL.md:1314-1323 SKILL.md:1323-1328 SKILL.md:1328-1341 SKILL.md:1341-1342 SKILL.md:1342-1343 SKILL.md:1343-1351 SKILL.md:1351-1354 SKILL.md:1354-1357 SKILL.md:1357-1359 SKILL.md:1359-1372 SKILL.md:1372-1374 SKILL.md:1374-1377 SKILL.md:1377-1379 SKILL.md:1379-1381 SKILL.md:1381-1389 SKILL.md:1389-1395 SKILL.md:1395-1398 SKILL.md:1398 SKILL.md:1407-1408 SKILL.md:1408-1413 SKILL.md:1413-1420 SKILL.md:1420-1438 SKILL.md:1438-1439 SKILL.md:1439 SKILL.md:1443-1465 SKILL.md:1465-1467 SKILL.md:1467-1471 SKILL.md:1471-1479 SKILL.md:1479 SKILL.md:1484-1489 SKILL.md:1489-1494 SKILL.md:1494-1502 SKILL.md:1502 SKILL.md:1503-1505 SKILL.md:1505-1510 SKILL.md:1510-1545 SKILL.md:1545-1546 SKILL.md:1546-1549 SKILL.md:1549-1550 SKILL.md:1550-1552 SKILL.md:1552-1563 SKILL.md:1563-1566 SKILL.md:1566-1567 SKILL.md:1567-1575 SKILL.md:1575 SKILL.md:1579-1583 SKILL.md:1583-1594 SKILL.md:1594-1596 SKILL.md:1596-1597 SKILL.md:1597-1612 SKILL.md:1612-1617 SKILL.md:1617-1620 SKILL.md:1620-1652 SKILL.md:1652-1668 SKILL.md:1668-1681 SKILL.md:1681-1683 SKILL.md:1683-1684 SKILL.md:1684-1700 SKILL.md:1700-1704 SKILL.md:1704 SKILL.md:1710-1722 SKILL.md:1722-1724 SKILL.md:1724-1725 SKILL.md:1725 SKILL.md:1726-1738 SKILL.md:1738-1739 SKILL.md:1739-1740 SKILL.md:1740-1741 SKILL.md:1741-1752 SKILL.md:1752-1753 SKILL.md:1753-1755 SKILL.md:1755-1756 SKILL.md:1756-1758 SKILL.md:1758-1765 SKILL.md:1765 SKILL.md:1769-1770 SKILL.md:1770-1771 SKILL.md:1771-1772 SKILL.md:1772-1773 SKILL.md:1773-1774 SKILL.md:1774-1779 SKILL.md:1779-1782 SKILL.md:1782-1784 SKILL.md:1784-1797 SKILL.md:1797 SKILL.md:1799-1813 SKILL.md:1813-1814 SKILL.md:1814-1820 SKILL.md:1820-1824 SKILL.md:1824-1828 SKILL.md:1828-1842 SKILL.md:1842-1844 SKILL.md:1844 SKILL.md:1847-1849 SKILL.md:1286-1287 SKILL.md:1290-1292 SKILL.md:1284-1298 SKILL.md:1502 SKILL.md:1503 ui-templates/agentcall-audio.js:10 ui-templates/agentcall-audio.js:11 ui-templates/agentcall-audio.js:306 ui-templates/avatar/index.html:222 ui-templates/avatar/index.html:238 ui-templates/dashboard/index.html:53 ui-templates/dashboard/index.html:61 ui-templates/orb/index.html:68 ui-templates/orb/index.html:69 ui-templates/orb/index.html:77 ui-templates/orb/index.html:78 ui-templates/orb/index.html:161 ui-templates/pattern/index.html:246 ui-templates/pattern/index.html:357 ui-templates/ring/index.html:109 ui-templates/ring/index.html:110 ui-templates/ring/index.html:111 ui-templates/ring/index.html:112 ui-templates/ring/index.html:119 ui-templates/ring/index.html:121 ui-templates/ring/index.html:129 ui-templates/ring/index.html:136 ui-templates/ring/index.html:217
Detected Patterns
Screen capture upload×3
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/pattern-ai-labs-join-meeting/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/pattern-ai-labs-join-meeting?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/pattern-ai-labs-join-meeting?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/pattern-ai-labs-join-meeting/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/pattern-ai-labs-join-meeting.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
pattern-ai-labs. (2026). join-meeting security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/pattern-ai-labs-join-meeting/audits/4BibTeX citation
@techreport{pattern-ai-labs-pattern-ai-labs-join-meeting-2026,
author = {pattern-ai-labs},
title = {join-meeting security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/pattern-ai-labs-join-meeting/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "join-meeting security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "pattern-ai-labs"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/pattern-ai-labs-join-meeting/audits/4"
identifiers:
- type: other
value: "skillstore:pattern-ai-labs-join-meeting:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 86
Architecture
85
Maintainability
87
Content
67
Community
70
Spec Compliance
What You Can Build
Pair Programming Call
Let a coding agent discuss code, answer questions, and share progress during a live engineering meeting.
Support or Demo Assistant
Join a customer call with a voice assistant that can answer questions and share visual materials.
Meeting Notes and Follow-Up
Use passive mode to collect transcripts, summarize decisions, and prepare action items after the call.
Try These Prompts
Join a Meeting
Join this meeting as a helpful voice participant: <meeting link>. Use audio mode and introduce yourself when someone joins.
Take Silent Notes
Join this meeting as a silent note taker: <meeting link>. Do not speak. Summarize decisions and action items after it ends.
Join With Avatar
Join this meeting with an avatar and collaborative voice: <meeting link>. Use the default visual template and respond when addressed.
Run a Guarded Working Session
Join this meeting for a coding session: <meeting link>. Use restricted tool permissions, confirm before file edits, and share progress visually.
Best Practices
- Use trusted meetings and restrict agent permissions before joining calls.
- Tell participants when the bot records transcripts, screenshots, audio, or screenshare content.
- End calls cleanly and remove temporary files that contain meeting content.
Avoid
- Do not join untrusted calls with file write, shell, or deployment permissions enabled.
- Do not expose arbitrary localhost ports through the tunnel.
- Do not use screenshots or recording features without participant consent.
Frequently Asked Questions
Which meeting platforms does this support?
The skill is designed for Google Meet, Zoom, and Microsoft Teams through AgentCall.
Does it require an AgentCall API key?
Yes. The scripts read an AgentCall API key from an environment variable or local config file.
Can the bot speak during the meeting?
Yes. It can use direct text-to-speech or collaborative voice intelligence for group conversations.
Can it run inside Claude Code or Codex?
Yes. It lists support for Claude, Codex, and Claude Code, plus other subprocess-capable agents.
What data leaves my machine?
Meeting URLs, transcripts, audio, screenshots, tunnel traffic, and control events can pass through AgentCall services.
Is it safe for confidential meetings?
Only with explicit consent, trusted participants, restricted agent permissions, and clear data handling controls.
Developer Details
Author
pattern-ai-labsLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
e397ce5a135369cd6def89cb6400d013e2f68f2f
Maintenance freshness
7/18/2026
Usage
3 downloads · 0 views