The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates real-time audio interaction where user speech is transcribed and processed by an LLM (gemma-4). This introduces a standard attack surface for indirect prompt injection common to voice-enabled agents, where spoken instructions could attempt to influence the agent's behavior or tool usage. The instructions do not define specific sanitization routines for the transcription output.
[COMMAND_EXECUTION]: The provided Node.js relay example implements a local WebSocket server to proxy traffic between the client and the Zoom service. The script uses standard libraries and does not involve arbitrary command execution or unsafe processing of shell inputs.
[CREDENTIALS_UNSAFE]: The skill follows recommended security practices by using environment variables (ZOOM_AI_SERVICES_API_KEY) for authentication. It explicitly warns against hardcoding keys and provides a relay mechanism to ensure secrets remain on the server and are never exposed to browser-based clients.
[EXTERNAL_DOWNLOADS]: The skill communicates with official Zoom API endpoints (api.zoom.us) and references legitimate developer documentation. These resources are well-known and represent standard integration points for the service.

voice-agent