zoom-mcp

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes an explicit CLI example embedding an OAuth bearer token in an Authorization header (Authorization: Bearer YOUR_ZOOM_OAUTH_TOKEN), which encourages placing secret tokens directly into generated commands/requests.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's SKILL.md and example workflows (e.g., examples/search-chat-docs.md, examples/transcript-retrieval.md and references/tools.md) explicitly instruct the agent to call MCP tools like search_meetings, search_zoom, get_file_content and get_meeting_assets to fetch and read user-generated Team Chat messages, Zoom Docs, meeting transcripts and recording assets, so untrusted third-party content is ingested and can influence subsequent tool use or actions.