zoom-video-sdk-unity
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Video SDK sessions, specifically through fields like
userNameandsessionNameas seen inexamples/session-join-pattern.md. - Ingestion points: Data enters the Unity environment via
zoomSdk.JoinSessionand event callbacks such asHandleSessionJoin. - Capability inventory: The skill is designed to map these inputs to Unity scene objects and UI elements.
- Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat these external strings strictly as data rather than instructions.
- Sanitization: The provided examples do not include sanitization or validation logic for display names or session identifiers, which could allow maliciously crafted strings to influence agent behavior if processed in a conversational context.
Audit Metadata