zoom-webhooks
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements best practices for secret management by instructing users to use environment variables (e.g., ZOOM_WEBHOOK_SECRET_TOKEN in .env files) rather than hardcoding sensitive credentials.
- [EXTERNAL_DOWNLOADS]: The documentation references hookdeck-cli, a developer tool provided by the vendor (hookdeck), to facilitate local development and webhook tunneling. This is a vendor-owned resource used appropriately for its intended purpose.
- [PROMPT_INJECTION]: The skill is designed to process untrusted external data (Zoom webhooks), which constitutes an indirect prompt injection surface. The risk is effectively mitigated by the following implementation details:
- Ingestion points: Webhook endpoints are defined in examples/express/src/index.js, examples/fastapi/main.py, and examples/nextjs/app/webhooks/zoom/route.ts.
- Boundary markers: Mandatory HMAC-SHA256 signature verification with timing-safe comparisons is implemented in all provided handler templates to ensure the authenticity and integrity of the incoming data.
- Capability inventory: The handlers are configured only to log event data to the console; they do not possess capabilities for subprocess execution, file system modification, or outbound network operations.
- Sanitization: Webhook payloads are parsed and processed only after successful signature verification against the vendor-provided secret token.
Audit Metadata