zoom-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external repositories for implementation samples.
- Official Zoom repositories (e.g.,
webhook-sample,Go-Webhooks) and well-known services like Splunk are cited as primary resources. - Community-contributed samples and multi-language implementations are listed to support various development stacks.
- Mentions
ngrok.comas a tool for local testing and development. - [COMMAND_EXECUTION]: Provides standard utility commands in
RUNBOOK.mdandreferences/subscriptions.mdfor developers to test their integration. - Includes
curlcommands for reachability and health checks on user-specified endpoints. - Mentions
pm2for service logging andngrokfor local tunneling during development. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for receiving and processing data from external sources via webhooks.
- Ingestion points: Webhook payloads (JSON) received at the user's defined server endpoints as described in
SKILL.mdandreferences/verification.md. - Boundary markers: The provided documentation focuses on server-side logic and does not define specific delimiters for LLM context, but strongly recommends cryptographic verification of all incoming data.
- Capability inventory: The included code snippets utilize network operations (
axios) and standard cryptographic functions (crypto). - Sanitization: The skill emphasizes HMAC-SHA256 signature verification using the
x-zm-signatureheader and secret tokens to ensure data authenticity and integrity.
Audit Metadata