video-sdk/linux

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In examples/command-channel.md, the runtime receives participant-authored free text via the Zoom Video SDK command channel callback onCommandReceived(..., strCmd) and passes the received command string to user code (potentially to an LLM) without any requirement to pre-select a trusted item.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill contains explicit instructions to run sudo apt install (and repeated sudo commands) which request elevated privileges and modify system packages/files, so it pushes actions that can compromise the machine state.