zoom-meeting
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with official Zoom API endpoints (zoom.us and api.zoom.us), which are well-known services. The network operations are limited to these trusted domains.
- [SAFE]: Credential management follows standard security practices. The setup instructions guide users to store sensitive keys (Client ID, Client Secret) in a .env file and explicitly recommend adding this file to .gitignore to prevent accidental exposure.
- [SAFE]: The use of Base64 encoding in the setup script is for standard OAuth Basic Authentication header construction, not for obfuscating malicious payloads.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection. 1. Ingestion points: Contact names and emails retrieved from the get-contact tool and user input. 2. Boundary markers: Not present in the provided instructions. 3. Capability inventory: Tool calls to create Zoom meetings, calendar events, and send WhatsApp notifications. 4. Sanitization: Not explicitly implemented in the skill instructions. The risk is assessed as safe given the specific scheduling context.
Audit Metadata