The Agent Skills Directory

[DATA_EXFILTRATION]: The skill uses standardized environment variable names (e.g., ZOOM_CLIENT_ID, ZOOM_ACCOUNT_ID) and placeholders for all sensitive credentials. It follows security best practices by recommending the use of secret managers and instructing users to never commit or log access tokens or client secrets.
[EXTERNAL_DOWNLOADS]: All external URLs and dependencies point to official Zoom domains (zoom.us, marketplace.zoom.us), official Zoom GitHub repositories (e.g., github.com/zoom/rivet-javascript), or established public registries (NPM). These are trusted resources required for the skill's primary purpose.
[COMMAND_EXECUTION]: Includes numerous curl examples and script snippets for Node.js and Python. These are benign instructional commands designed to interact with authenticated Zoom API endpoints and do not contain dangerous shell operators or malicious logic.
[OBFUSCATION]: Base64 encoding is demonstrated in the context of constructing HTTP Basic Authentication headers for OAuth token exchanges. This is a standard architectural requirement and is used here in an illustrative, non-malicious manner.
[INDIRECT_PROMPT_INJECTION]: The skill provides examples of systems that ingest data (e.g., webhook receivers for meeting events). However, it mitigates potential risks by documenting the implementation of HMAC-SHA256 signature verification and Challenge-Response Check (CRC) validation to ensure all processed data originates from a verified source.

build-zoom-rest-api-app