virtual-agent/web
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the official Zoom SDK hosted at
https://us01ccistatic.zoom.us/us01cci/web-sdk/zcc-sdk.js. This is a standard resource for the Zoom Virtual Agent service. - [REMOTE_CODE_EXECUTION]: Examples in
examples/campaign-and-entry-patterns.mddemonstrate how to embed the vendor's JavaScript SDK. The execution is limited to the functionality provided by the official SDK on the user's web platform. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of user-specific data into the virtual agent context, which represents a standard attack surface for indirect injection.
- Ingestion points: User context variables like
firstNameandemailare defined inexamples/campaign-and-entry-patterns.mdand passed to the SDK. - Boundary markers: The provided code examples do not include explicit delimiters or guardrail instructions for user-supplied data.
- Capability inventory: The SDK supports methods such as
updateUserContext()andChangeCampaign()as listed inconcepts/lifecycle-and-events.md. - Sanitization: No sanitization logic is present in the documentation examples, as it is intended for demonstration of SDK usage.
Audit Metadata