zoom-video-sdk-macos
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation, architectural concepts, and Swift code examples for the Zoom Video SDK on macOS. Analysis of the instructions and scripts reveals no malicious patterns, prompt injections, or unauthorized data access.- [INDIRECT_PROMPT_INJECTION]: The skill documents the implementation of a communication SDK which inherently processes external data (e.g., participant display names, chat messages, and signaling data). This represents a standard attack surface for applications processing untrusted network data.
- Ingestion points: Event streams and callbacks defined in
ZMVideoSDKDelegate(mentioned inreferences/macos-reference-map.mdandconcepts/lifecycle-workflow.md). - Boundary markers: Not explicitly defined in the high-level documentation; implementation of data validation is deferred to the application developer.
- Capability inventory: The SDK facilitates media streaming (audio/video), screen sharing, and session control as described in
examples/session-join-pattern.md. - Sanitization: The documentation focuses on SDK lifecycle and resource management; sanitization of received session data is expected to be handled by the developer within the delegate callbacks.- [CREDENTIALS_UNSAFE]: The skill mentions sensitive environment variables such as
ZOOM_VIDEO_SDK_KEYandZOOM_VIDEO_SDK_SECRETinreferences/environment-variables.md. However, these are presented as configuration requirements for the developer to populate from their own environment, and the skill correctly identifies that secrets should be stored server-side. No actual credentials or secrets are hardcoded in the skill files.
Audit Metadata