zoom-apps-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides developer documentation for the official Zoom Apps SDK (@zoom/appssdk) and uses standard patterns for web application development within the Zoom ecosystem.
- [SAFE]: Security best practices are integrated throughout the documentation, specifically covering the requirement for HTTPS, OWASP security headers (Strict-Transport-Security, X-Content-Type-Options, Content-Security-Policy), and secure cookie configurations (SameSite=None, Secure) necessary for cross-origin embedded browser environments.
- [SAFE]: Authentication examples utilize the In-Client OAuth flow with Proof Key for Code Exchange (PKCE), which is the recommended secure pattern for Zoom Apps to prevent authorization code interception and CSRF attacks.
- [SAFE]: Sensitive configuration values such as Client IDs and Secrets are appropriately represented as placeholders (e.g., 'your_client_id'), with explicit instructions to manage them securely using environment variables and secret managers rather than hardcoding them in the repository.
- [SAFE]: The skill includes informative references to community repositories and official samples from the vendor, but does not perform automated installations or script executions from untrusted third-party sources.
Audit Metadata