Atlas / Skills / n8n-io / Loom Transcript

Loom TranscriptBLOCK

skills/n8n-io/loom-transcript

Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Version
—
Hosts
—
License
NOASSERTION
Stars
208,375
01

Overview

Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.

Read from source at commit 311b4334f007OBSERVED · 2026-10-23
Advertisement
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: n8n:loom-transcript
description: Fetch and display the full transcript from a Loom video URL. Use when the user wants to get or read a Loom transcript.
argument-hint: [loom-url]
---

# Loom Transcript Fetcher

Fetch the transcript from a Loom video using Loom's GraphQL API.

## Instructions

Given the Loom URL: $ARGUMENTS

### 1. Extract the Video ID

Parse the Loom URL to extract the 32-character hex video ID. Supported URL formats:
- `https://www.loom.com/share/<video-id>`
- `https://www.loom.com/embed/<video-id>`
- `https://www.loom.com/share/<video-id>?sid=<session-id>`

The video ID is the 32-character hex string after `/share/` or `/embed/`.

### 2. Fetch Video Metadata

Use the `WebFetch` tool to POST to `https://www.loom.com/graphql` to get the video title and details.

Use this curl command via Bash:

```bash
curl -s 'https://www.loom.com/graphql' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'x-loom-request-source: loom_web_45a5bd4' \
  -H 'apollographql-client-name: web' \
  -H 'apollographql-client-version: 45a5bd4' \
  -d '{
    "operationName": "GetVideoSSR",
    "variables": {"id": "<VIDEO_ID>", "password": null},
    "query": "query GetVideoSSR($id: ID!, $password: String) { getVideo(id: $id, password: $password) { ... on RegularUserVideo { id name description createdAt owner { display_name } } } }"
  }'
```

### 3. Fetch the Transcript URLs

Use curl via Bash to call the GraphQL API:

```bash
curl -s 'https://www.loom.com/graphql' \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -H 'x-loom-request-source: loom_web_45a5bd4' \
  -H 'apollographql-client-name: web' \
  -H 'apollographql-client-version: 45a5bd4' \
  -d '{
    "operationName": "FetchVideoTranscript",
    "variables": {"videoId": "<VIDEO_ID>", "password": null},
    "query": "query FetchVideoTranscript($videoId: ID!, $password: String) { fetchVideoTranscript(videoId: $videoId, password: $password) { ... on VideoTranscriptDetails { id video_id source_url captions_source_url } ... on GenericError { message } } }"
  }'
```

Replace `<VIDEO_ID>` with the actual video ID extracted in step 1.

The response contains:
- `source_url` — JSON transcript URL
- `captions_source_url` — VTT (WebVTT) captions URL

### 4. Download and Parse the Transcript

Fetch **both** URLs returned from step 3 (if available):

1. **VTT captions** (`captions_source_url`): Download with `curl -sL "<url>"`. This is a WebVTT file with timestamps and text.
2. **JSON transcript** (`source_url`): Download with `curl -sL "<url>"`. This is a JSON file with transcript segments.

Prefer the VTT captions as the primary source since they include proper timestamps. Fall back to the JSON transcript if VTT is unavailable.

### 5. Present the Transcript

Format and present the full transcript to the user:

**Video:** [Title from metadata]
**Author:** [Owner name]
**Date:** [Created date]

---

**0:00** - First transcript segment text...

**0:14** - Second transcript segment text...

(continue for all segments)

---

## Error Handling

- If the GraphQL response contains a `GenericError`, report the error message to the user.
- If both `source_url` and `captions_source_url` are null/missing, tell the user that no transcript is available for this video.
- If the video URL is invalid or the ID cannot be extracted, ask the user for a valid Loom URL.

## Notes

- No authentication or cookies are required — Loom's transcript API is publicly accessible.
- Only English transcripts are available through this API.
- Transcripts are auto-generated and may contain minor errors.
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (2 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (6)

CRITICALPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
SKILL.md:20
- `https://www.loom.com/share/<video-id>?sid=<session-id>`
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/plugins/n8n/skills/agent-design-language
.claude/plugins/n8n/skills/agent-design-language
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/plugins/n8n/skills/community-pr-readiness-check
.claude/plugins/n8n/skills/community-pr-readiness-check
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/plugins/n8n/skills/content-design
.claude/plugins/n8n/skills/content-design
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/plugins/n8n/skills/conventions
.claude/plugins/n8n/skills/conventions
Why it matters. link not followed
MEDIUMInventory / provenance · inv.symlink · CWE-1104
.claude/plugins/n8n/skills/create-agent-builder-eval
.claude/plugins/n8n/skills/create-agent-builder-eval
Why it matters. link not followed

Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.

Audited 2026-10-23 · audit v0.4.1 · source sha 311b4334f007full audit observations/trust-audit/skill/n8n-io__loom-transcript.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-23311b4334f007BLOCKD69first audit
05

Questions

What does the loom-transcript — n8n-io/n8n skill do?

Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.

Is loom-transcript — n8n-io/n8n safe to install?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.

What can loom-transcript — n8n-io/n8n access on my machine?

The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.

How current is this page?

The grade is for one exact copy of the source (311b4334f007), read on 2026-10-23. The repository is watched, and a new audit runs when it changes — this is the first audit.

Add this badge to your README

Shows this page's audit result and links back to it. It updates when the audit does.

ModelsAtlas audit badge

Markdown
[![ModelsAtlas audit: Loom Transcript](https://modelsatlas.com/skills/n8n-io/loom-transcript/badge.svg)](https://modelsatlas.com/skills/n8n-io/loom-transcript/)

Not your listing, or something out of date? Claim or update your listing.

Advertisement