contact-center
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides links to official developer resources and references SDK binaries for implementation.
- References official Zoom documentation at
developers.zoom.usand SDK binary references such asios-zccsdk-5.2.0.zip. - Links to official sample applications hosted in the
zoomorganization on GitHub (e.g.,github.com/zoom/zcc-nextjs-sample). - [INDIRECT_PROMPT_INJECTION]: The skill architecture handles dynamic engagement context data, which constitutes a potential injection surface.
- Ingestion points: The skill utilizes the
getEngagementContextandonEngagementStatusChangeAPIs to ingest external session data as described inSKILL.mdandRUNBOOK.md. - Boundary markers: The documentation does not specify the use of delimiters or instructions for the agent to ignore embedded commands within the engagement context.
- Capability inventory: The skill focuses on UI lifecycle management and state persistence using the Zoom Apps SDK and does not instruct the agent to execute shell commands, perform arbitrary file writes, or initiate non-SDK network operations.
- Sanitization: No explicit data validation or sanitization procedures are mentioned for processing the incoming engagement context string or object data.
- [NO_CODE]: The skill package is composed entirely of Markdown instructional files and configuration, containing no executable scripts or source code files.
Audit Metadata