n8n:loom-transcript — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited n8n:loom-transcript (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fetch the transcript from a Loom video using Loom's GraphQL API.
Given the Loom URL: $ARGUMENTS
Parse the Loom URL to extract the 32-character hex video ID. Supported URL formats:
https://www.loom.com/share/<video-id>https://www.loom.com/embed/<video-id>https://www.loom.com/share/<video-id>?sid=<session-id>The video ID is the 32-character hex string after /share/ or /embed/.
Use the WebFetch tool to POST to https://www.loom.com/graphql to get the video title and details.
Use this curl command via Bash:
curl -s 'https://www.loom.com/graphql' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'x-loom-request-source: loom_web_45a5bd4' \
-H 'apollographql-client-name: web' \
-H 'apollographql-client-version: 45a5bd4' \
-d '{
"operationName": "GetVideoSSR",
"variables": {"id": "<VIDEO_ID>", "password": null},
"query": "query GetVideoSSR($id: ID!, $password: String) { getVideo(id: $id, password: $password) { ... on RegularUserVideo { id name description createdAt owner { display_name } } } }"
}'Use curl via Bash to call the GraphQL API:
curl -s 'https://www.loom.com/graphql' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'x-loom-request-source: loom_web_45a5bd4' \
-H 'apollographql-client-name: web' \
-H 'apollographql-client-version: 45a5bd4' \
-d '{
"operationName": "FetchVideoTranscript",
"variables": {"videoId": "<VIDEO_ID>", "password": null},
"query": "query FetchVideoTranscript($videoId: ID!, $password: String) { fetchVideoTranscript(videoId: $videoId, password: $password) { ... on VideoTranscriptDetails { id video_id source_url captions_source_url } ... on GenericError { message } } }"
}'Replace <VIDEO_ID> with the actual video ID extracted in step 1.
The response contains:
source_url — JSON transcript URLcaptions_source_url — VTT (WebVTT) captions URLFetch both URLs returned from step 3 (if available):
captions_source_url): Download with curl -sL "<url>". This is a WebVTT file with timestamps and text.source_url): Download with curl -sL "<url>". This is a JSON file with transcript segments.Prefer the VTT captions as the primary source since they include proper timestamps. Fall back to the JSON transcript if VTT is unavailable.
Format and present the full transcript to the user:
Video: [Title from metadata] Author: [Owner name] Date: [Created date]
0:00 - First transcript segment text...
0:14 - Second transcript segment text...
(continue for all segments)
GenericError, report the error message to the user.source_url and captions_source_url are null/missing, tell the user that no transcript is available for this video.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.