zoom-meeting-sdk-web-component-view
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill correctly references the official Zoom SDK NPM package (@zoom/meetingsdk) and dependencies hosted on the official Zoom CDN (source.zoom.us). These are trusted, vendor-owned resources required for the SDK to function.
- [INDIRECT_PROMPT_INJECTION]: The skill documents how to handle real-time chat data through the 'chat-on-message' event listener, which introduces a surface for indirect prompt injection. 1. Ingestion points: The 'chat-on-message' event listener described in SKILL.md. 2. Boundary markers: There are no explicit instructions or delimiters shown to prevent the agent from interpreting content within the chat messages as commands. 3. Capability inventory: The skill provides extensive control over the meeting environment, including participant management, audio/video controls, and cloud recording. 4. Sanitization: The provided examples do not include logic for sanitizing or validating the contents of incoming chat messages.
Audit Metadata