recall-ai-integration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited recall-ai-integration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Recall.ai is a meeting-bot vendor — you dispatch a bot to a Google Meet / Zoom / Teams URL, it joins, captures audio + transcripts, accepts commands (speak, chat, leave), and webhooks you status + realtime events. This skill also covers two closely-coupled ElevenLabs surfaces — Scribe (Recall's recording_config.transcript.provider alternate to meeting_captions) and Voice (the documented TTS swap target) — because the wire-contract rules and quality gates apply identically and the swaps tend to live next to each other in the codebase.
Why this skill exists. Two real production incidents (May 2026) — in_call_recording.data was assumed to be a scalar when it's a nested object, and an OpenAI Realtime route 502'd because the session schema changed silently — both traced to the same root cause: code written from training-memory intuition instead of from a live doc read + sandbox probe. This skill exists so the next agent reads + probes before coding.
The skill is modular. The body below is a manifest; depth lives in references/. Load only what the current task needs.
This skill was extracted from a Next.js + TypeScript codebase. The reference files cite example file paths (e.g. lib/meet/bot-client.ts, app/api/meet/webhook/status/route.ts, synthesizeSpeech, MeetingBotClient) to make the contracts concrete. These are examples of where the vendor seam might live, not paths that need to exist in your repo. Map them to your own structure as you read:
MeetingBotClient" / "bot-client.ts" → your single wrapper class around all Recall HTTP calls (so the documented Attendee fallback stays a one-class swap).synthesizeSpeech" / "lib/meet/tts.ts" → your single seam for TTS (so the OpenAI ↔ ElevenLabs Voice swap is local)./api/meet/webhook/status" / "/api/meet/webhook/realtime" → your two webhook routes for Recall's two channels.Personal_Docs/..." prefixes → your app root.The vendor wire contracts, event shapes, gotchas, and methodology are universally applicable — every Recall.ai + ElevenLabs integration hits the same constraints.
Classify the request and announce the mode in one sentence before any tool call.
| Mode | Triggers | Track |
|---|---|---|
| Feature/Modify | "add Recall …", "extend speak", "wire up bot.X event", new endpoint method, new event subscription, new bot-create field | references/workflow-feature.md |
| Bug-fix | "speak 502", "transcript stalled", "Svix verify failing", "bot won't join", "404 on /output_audio/", "waiting room never resolves" | references/workflow-bug-fix.md |
| Question | "how does …", "what does Recall send for …", "where is …" — no change requested | Question track (below) |
If ambiguous, ask which mode applies before continuing.
Treat as progressive disclosure. Start with the always-load pair; pull others as the work expands.
/status vs /realtime side-by-side, event catalog, payload shapes, seq derivation, spec-faithful fixture worked example.speak and chat as worked examples.Feature: walk every phase in workflow-feature.md. Hard-block phases cannot be skipped.
Bug-fix: walk every phase in workflow-bug-fix.md. All hard-block.
Question: read the file the user is asking about (don't summarize from memory). Cite specific paths and line numbers. Keep the answer terse. If the question turns into a change mid-conversation, restart from Step 1.
Full list with rule citations in refusals.md. Headlines:
// [Doc check YYYY-MM-DD: <URL>]. Fix path: read the live doc, probe sandbox, then code.in_call_recording.data is nested { data: { kind, b64_data } } at bot-create; /output_audio/ is flat { kind, b64_data } mid-call. Change one site → audit all three (dispatchBot, pushAudio, any handler that constructs the same shape).transcript.data carries cumulative semantics across events — single-event fixtures don't exercise the seq monotonic CAS and miss whole classes of bugs./status only; ?token= on /realtime only. The auth schemes are channel-locked — different routes, different verifiers.synthesizeSpeech seam — that's the OpenAI ↔ ElevenLabs Voice swap site.lint, format:check, typecheck, knip if configured, scoped tests), run them — no --no-verify, no rule loosening.// [Doc check YYYY-MM-DD: <URL>] with today's date and a working docs.recall.ai URL.transcript.data, double-nested envelope, real start_timestamp.relative values, full metadata.userId.in_call_recording / output_audio / any field where create-time and mid-call shapes diverge.If any box is unchecked, you're not done. Loop back to the failing phase.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.