The Agent Skills Directory

Indirect Prompt Injection Surface: The skill provides templates for building chatbots that ingest untrusted user input from Zoom webhooks (e.g., payload.cmd in routes/webhook.js). This content is intended for processing by LLMs, which creates a surface for potential indirect prompt injection. The documentation mitigates this by providing a sanitizeMessage utility in utils/validation.js and explicitly advising that submitted text be treated as untrusted input.\n- Secure Authentication and Secret Management: The skill demonstrates standard OAuth 2.0 and Client Credentials flows. It follows industry best practices by utilizing environment variables for credentials like ZOOM_CLIENT_SECRET and ZOOM_BOT_JID, ensuring sensitive information is not hardcoded within the application logic.\n- Webhook Verification: The examples include a robust implementation for verifying the authenticity of incoming webhooks using Zoom's x-zm-signature header and HMAC-SHA256, which prevents the bot from responding to unauthorized or spoofed requests.

build-zoom-team-chat-app