skills/zoom/skills/zoom-webhooks/Gen Agent Trust Hub

zoom-webhooks

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references several external repositories for implementation samples.
  • Official Zoom repositories (e.g., webhook-sample, Go-Webhooks) and well-known services like Splunk are cited as primary resources.
  • Community-contributed samples and multi-language implementations are listed to support various development stacks.
  • Mentions ngrok.com as a tool for local testing and development.
  • [COMMAND_EXECUTION]: Provides standard utility commands in RUNBOOK.md and references/subscriptions.md for developers to test their integration.
  • Includes curl commands for reachability and health checks on user-specified endpoints.
  • Mentions pm2 for service logging and ngrok for local tunneling during development.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for receiving and processing data from external sources via webhooks.
  • Ingestion points: Webhook payloads (JSON) received at the user's defined server endpoints as described in SKILL.md and references/verification.md.
  • Boundary markers: The provided documentation focuses on server-side logic and does not define specific delimiters for LLM context, but strongly recommends cryptographic verification of all incoming data.
  • Capability inventory: The included code snippets utilize network operations (axios) and standard cryptographic functions (crypto).
  • Sanitization: The skill emphasizes HMAC-SHA256 signature verification using the x-zm-signature header and secret tokens to ensure data authenticity and integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 10:24 AM