skills/zoom/skills/scribe/Gen Agent Trust Hub

scribe

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the transcription of media files (audio/video), which serves as an ingestion point for untrusted external data into the agent's context.
  • Ingestion points: The POST /aiservices/scribe/transcribe and POST /aiservices/scribe/jobs endpoints described in SKILL.md and examples/fast-mode-node.md process media files from direct uploads and cloud storage.
  • Boundary markers: The provided instructions and code snippets do not include specific delimiters or instructions to the agent to ignore potentially malicious commands embedded within the transcribed text.
  • Capability inventory: The skill utilizes network capabilities (fetch) and file handling (multer) in examples/fast-mode-node.md to interact with Zoom's API endpoints.
  • Sanitization: There is no mention of sanitizing or validating the content of the media files or the resulting transcriptions before they are used or displayed.
  • [SAFE]: The skill references official Zoom developer resources and repositories, such as github.com/zoom/ai-services-quickstart, which are maintained by the vendor.
  • [SAFE]: Code examples utilize standard, well-maintained Node.js packages including express, multer, and jsrsasign for processing requests and managing authentication.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 06:34 AM