The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to handle user-provided input such as userName, sessionName (tpc), and token which are interpolated into SDK commands. While these are standard parameters for video conferencing, they represent ingestion points for untrusted data if not properly validated by the consuming application.
Ingestion points: userName, topic in SKILL.md and references/get_started.md.
Boundary markers: Examples do not explicitly show delimiters for these specific strings when passing them to client.join().
Capability inventory: The skill has capabilities to access camera/microphone and send chat messages.
Sanitization: Not explicitly documented in the frontend examples, as validation typically occurs on the backend during token generation.
[DYNAMIC_EXECUTION]: The skill documents the use of stream.createProcessor to load and execute external JavaScript files within Web Workers for raw media processing (watermarks, filters, etc.), as seen in references/advanced.md and references/raw-data/raw-data-video.md.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of official Zoom SDK assets from well-known vendor domains including source.zoom.us and dmogdx0jrul3u.cloudfront.net (Zoom's CDN). It also references official GitHub repositories for framework-specific libraries.

video-sdk-web