跳到主要内容
知仓学习社ZHICANG

granola

This skill should be used when importing, listing, or exporting Granola meeting recordings and transcripts. Queries Granola's Personal API to list m…

读凭据执行命令联网严重 4 · 高危 1glebis/claude-skills

它会碰到什么

扫了多少14 个文本文件,24 KB
它会碰到什么读凭据执行命令联网
命中总数10 处
命中统计严重 4 · 高 1 · 中 4 · 低 1

这个仓库里自带 2 个测试样本文件(有些技能仓会放故意的恶意样本做演示),它们不计入上面的能力与命中。

逐条看命中(5 条严重或高危)
  • 严重 references/cache-structure.md:15cred-paths
    Key stored sops-encrypted at `~/Brains/brain/.env.granola` as `GRANOLA_API_KEY=grn_...`.
  • 严重 scripts/granola.py:15cred-paths
    SOPS_ENV_PATH = os.path.expanduser("~/Brains/brain/.env.granola")
  • 严重 scripts/granola.py:19cred-paths
    """Decrypt Personal API Key from sops-encrypted .env.granola."""
  • 严重 SKILL.md:13cred-paths
    - API key in sops-encrypted `~/Brains/brain/.env.granola` as `GRANOLA_API_KEY=grn_...`
  • scripts/granola.py:21exec-spawn
    result = subprocess.run(

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Granola Meeting Importer

Query Granola via Personal API to list notes, view transcripts, and export to Obsidian vault in the same format as the Fathom skill.

Prerequisites

  • Granola Business or Enterprise plan (Personal API required)
  • API key in sops-encrypted ~/Brains/brain/.env.granola as GRANOLA_API_KEY=grn_...
  • No additional dependencies (uses stdlib only)

Usage

python3 ~/.claude/skills/granola/scripts/granola.py <command> [options]

Commands

| Command | Description |

|---------|-------------|

| list | List notes from Personal API |

| show <note_id> | Show note details (summary, attendees, optionally transcript) |

| export <note_id> | Export note to Obsidian markdown (Fathom-compatible format) |

Options

| Option | Applies to | Description |

|--------|-----------|-------------|

| --format text\|json | list, show | Output format (default: text) |

| --after <ISO date> | list | Filter notes created after date |

| --all | list | Paginate through all results |

| --transcript | show | Include transcript in output |

| --vault <path> | export | Obsidian vault path (default: ~/Brains/brain) |

| --output <path> | export | Custom output file path |

Examples

List recent meetings

python3 ~/.claude/skills/granola/scripts/granola.py list
python3 ~/.claude/skills/granola/scripts/granola.py list --format json
python3 ~/.claude/skills/granola/scripts/granola.py list --after 2026-05-01

Show note with transcript

python3 ~/.claude/skills/granola/scripts/granola.py show not_5FkswTp4Omkpm5
python3 ~/.claude/skills/granola/scripts/granola.py show not_5FkswTp4Omkpm5 --transcript --format json

Export to Obsidian

python3 ~/.claude/skills/granola/scripts/granola.py export not_5FkswTp4Omkpm5
python3 ~/.claude/skills/granola/scripts/granola.py export not_5FkswTp4Omkpm5 --vault ~/Brains/brain

Output Format

Exported notes match Fathom skill format for consistency:

---
granola_id: not_xxxx
title: "Meeting Title"
date: YYYY-MM-DD
participants: ['Name 1', 'Name 2']
duration: HH:MM
source: granola
---

# Meeting Title

## Summary
{AI-generated summary}

## Transcript
**Speaker Name**: What they said...

Files saved as: Sessions/YYYYMMDD-meeting-title-slug.md

API Details

  • Base URL: https://public-api.granola.ai/v1
  • Auth: Bearer token (Personal API key, never expires)
  • Rate limits: 25 req burst / 5 req/sec sustained
  • Important: API only returns notes with generated summaries — in-progress meetings won't appear

Known Limitations

  • No live/in-progress access — notes appear only after Granola generates the AI summary
  • No per-utterance speaker names — Granola provides source (microphone vs speaker) and optional diarization_label. Export assigns meeting owner to microphone utterances
  • Note IDs required — use list first to get not_xxxx IDs, then show/export

Integration

  • transcript-analyzer: After export, run transcript-analyzer on the output file for deeper analysis
  • Fathom skill: Granola exports use the same frontmatter and transcript format as Fathom exports, so downstream tools work with both

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。