pp-zoom

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples and commands that extract and persist Zoom meeting passwords from URLs (e.g., ?pwd=abc) and demonstrates embedding those secrets directly in CLI invocations and outputs (and can deliver output to webhooks), which requires handling and can cause the LLM to emit secrets verbatim.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's prerequisite/install commands fetch and run remote code at runtime (npx -y @mvanhorn/printing-press-library install zoom --cli-only and go install github.com/mvanhorn/printing-press-library/library/productivity/zoom/cmd/zoom-pp-cli@latest), so the agent could execute externally-hosted code to install the required CLI.