skills/zoom/skills/zoom-websockets/Gen Agent Trust Hub

zoom-websockets

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process real-time data from external Zoom events, which could contain untrusted content.
  • Ingestion points: Data enters the system through the WebSocket message handler (ws.on('message')) as shown in SKILL.md and references/connection.md.
  • Boundary markers: The provided code snippets demonstrate direct parsing of JSON payloads without explicit delimiters or instructions to ignore embedded commands.
  • Capability inventory: The examples demonstrate logging and internal state updates based on event content, but do not show tool execution or file system writes based on the data.
  • Sanitization: Payloads such as meeting topics and participant names are accessed directly from the JSON object without sanitization.
  • [EXTERNAL_DOWNLOADS]: The skill references external libraries and service endpoints required for its functionality.
  • Infrastructure: The skill correctly directs authentication requests and WebSocket connections to Zoom's official domains (zoom.us).
  • Dependencies: Code templates utilize standard, well-known Node.js libraries axios and ws for HTTP and WebSocket operations.
  • Community Resources: Includes a link to a sample repository on GitHub (just-zoomit/zoom-websockets) for reference.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 10:24 AM