zoom-websockets
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process real-time data from external Zoom events, which could contain untrusted content.
- Ingestion points: Data enters the system through the WebSocket message handler (
ws.on('message')) as shown inSKILL.mdandreferences/connection.md. - Boundary markers: The provided code snippets demonstrate direct parsing of JSON payloads without explicit delimiters or instructions to ignore embedded commands.
- Capability inventory: The examples demonstrate logging and internal state updates based on event content, but do not show tool execution or file system writes based on the data.
- Sanitization: Payloads such as meeting topics and participant names are accessed directly from the JSON object without sanitization.
- [EXTERNAL_DOWNLOADS]: The skill references external libraries and service endpoints required for its functionality.
- Infrastructure: The skill correctly directs authentication requests and WebSocket connections to Zoom's official domains (
zoom.us). - Dependencies: Code templates utilize standard, well-known Node.js libraries
axiosandwsfor HTTP and WebSocket operations. - Community Resources: Includes a link to a sample repository on GitHub (
just-zoomit/zoom-websockets) for reference.
Audit Metadata