zoom-meeting-sdk-web
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, prompt injections, or unauthorized data exfiltration attempts were found. The skill follows standard developer integration patterns for the Zoom platform.
- [EXTERNAL_DOWNLOADS]: The skill directs the user to fetch official SDK components and sample code from verified sources.
- Recommends the @zoom/meetingsdk npm package.
- References official CDN assets at source.zoom.us and source.zoomgov.com.
- Points to the zoom/meetingsdk-auth-endpoint-sample repository on GitHub for signature generation logic.
- [INDIRECT_PROMPT_INJECTION]: The integration examples define how untrusted user data enters the application flow.
- Ingestion points: The userName, meetingNumber, and password fields are used as inputs for the client.join() and ZoomMtg.join() methods in SKILL.md and references/web.md.
- Boundary markers: Not present in the provided code snippets.
- Capability inventory: The SDK allows for bidirectional audio/video communication and data transfer (chat) over the network.
- Sanitization: Content is passed directly to the Zoom SDK, which is responsible for the secure rendering and transmission of meeting data.
- [COMMAND_EXECUTION]: The troubleshooting guide suggests standard diagnostic shell commands for developers.
- Evidence: Mentions of pm2 describe, grep, and ripgrep in troubleshooting/common-issues.md are used for auditing the local deployment environment and are not part of an automated or hidden execution chain.
Audit Metadata