zoom
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script executes a system command to automatically detect the user's timezone.
- Evidence: In
scripts/zoom_meetings.py,subprocess.runis used to callreadlink /etc/localtime. This is a benign operation used to ensure Zoom meetings are scheduled with the correct local time offset. - [INDIRECT_PROMPT_INJECTION]: The skill processes meeting data and recordings from the Zoom API, which is a standard data ingestion surface.
- Ingestion points: Meeting topics, agendas, and transcripts are retrieved via the Zoom API in
scripts/zoom_meetings.py. - Boundary markers: The skill presents meeting data to the agent in Markdown or JSON format without explicit delimiters to separate external content from instructions.
- Capability inventory: The skill allows the agent to create, update, and delete meetings based on these inputs.
- Sanitization: Data is retrieved directly from Zoom and passed to the agent's context without filtering.
Audit Metadata