zoom

The skill's stated purpose and Zoom-focused capabilities are broadly consistent, and its network destinations appear aligned with official Zoom OAuth/MCP usage. The main issue is trust in the required local `zoom` CLI and its undocumented `authd`/`CAGI` path: the skill asks the agent to rely on a binary and auth intermediary whose provenance is not established here. That makes this better classified as suspicious/high-risk dependency trust rather than confirmed malware.