teams-meeting-pipeline
Enables users to manage Microsoft Teams meeting summaries and subscriptions via the Hermes CLI, enhancing productivity and operations.
Install this skill
Security score
The teams-meeting-pipeline skill was audited on Jun 11, 2026 and we found 13 security issues across 4 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 42 | Before using the pipeline, verify these are set in `${HERMES_HOME:-~/.hermes}/.env`: |
Webhook reference - potential data exfiltration
| 33 | - manage Graph webhook subscriptions (create, renew, delete, inspect) |
Webhook reference - potential data exfiltration
| 63 | hermes teams-pipeline subscriptions # current Graph webhook subscriptions |
Webhook reference - potential data exfiltration
| 79 | --notification-url https://<your-public-host>/msgraph/webhook \ |
Webhook reference - potential data exfiltration
| 80 | --client-state "$MSGRAPH_WEBHOOK_CLIENT_STATE" |
Webhook reference - potential data exfiltration
| 90 | - User asks "why didn't I get a summary for today's meeting?" → start with `list --status failed`, then `show <job-id>` on the relevant row. If the job doesn't exist at all, check `subscriptions` — th |
Webhook reference - potential data exfiltration
| 97 | Microsoft Graph caps webhook subscriptions at 72 hours and **will not auto-renew them**. If `maintain-subscriptions` is not scheduled, meeting notifications silently stop arriving 3 days after any man |
Webhook reference - potential data exfiltration
| 106 | - **Transcript not available yet.** Teams takes some time after a meeting ends to generate the transcript artifact. `fetch --meeting-id` on a just-ended meeting may return empty. Wait 2-5 minutes and |
Webhook reference - potential data exfiltration
| 107 | - **Delivery mode mismatch.** If summaries are produced (`list` shows success) but nothing lands in Teams, check `platforms.teams.extra.delivery_mode` and the matching target config (`incoming_webhook |
Webhook reference - potential data exfiltration
| 116 | - Webhook listener setup: `/docs/user-guide/messaging/msgraph-webhook` |
Access to hidden dotfiles in home directory
| 42 | Before using the pipeline, verify these are set in `${HERMES_HOME:-~/.hermes}/.env`: |
Access to .env file
| 42 | Before using the pipeline, verify these are set in `${HERMES_HOME:-~/.hermes}/.env`: |
External URL reference
| 79 | --notification-url https://<your-public-host>/msgraph/webhook \ |