rivet-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data through webhook event handlers (e.g.,
webEventConsumer.event("chat_message.sent", ...)). This constitutes an ingestion point for untrusted data from the Zoom platform. - Ingestion points: Webhook payloads processed in
examples/getting-started-pattern.mdandexamples/multi-client-pattern.md. - Boundary markers: No specific delimiters or "ignore instructions" warnings are present in the provided code snippets.
- Capability inventory: The skill allows for REST API operations through
client.endpoints.*wrappers. - Sanitization: The provided examples do not explicitly demonstrate sanitization of event payloads, which is a standard risk for skills processing external messaging data.
- [COMMAND_EXECUTION]: The skill provides patterns for starting a Node.js server instance using
client.start(), which binds the application to a local network port to receive webhooks. - [EXTERNAL_DOWNLOADS]: The skill references the official Zoom Rivet SDK package (
@zoom/rivet) and provides links to official documentation and sample repositories on GitHub. All external references target trusted vendor domains or well-known services associated with the skill author.
Audit Metadata