zoom-meeting-sdk-electron
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- Data Ingestion Surface (Indirect Prompt Injection): The skill describes scenarios such as AI-assisted copilots and compliance recorders that ingest raw meeting data (audio, video, chat). While these are intended features, they represent a surface where untrusted data from meeting participants could influence downstream AI processing. The documentation appropriately notes that raw data flows require hardening and performance monitoring.
- Ingestion points: Raw data modules, chat service, and participant information.
- Boundary markers: Not applicable as this is documentation, but it advises on secure data paths.
- Capability inventory: The SDK provides meeting control capabilities (audio/video toggling, participant management).
- Sanitization: The skill advises implementing access controls and encryption for raw data transport.
- Secret Management Best Practices: The skill correctly emphasizes that SDK secrets should never be persisted in the Electron bundle and that JWT generation must occur on a secure backend. This alignment with security best practices reduces the risk of credential exposure.
- Native Addon Dependencies: The integration relies on native Node.js addons which require specific build toolchains (e.g., Python, C++ compilers). The documentation notes potential version drift and the need for pinned dependencies to maintain a stable and secure build environment.
Audit Metadata