build-zoom-team-chat-app

Savant verdict: Unsafe

SkillSpector recommends not installing this skill.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Safety (NVIDIA SkillSpector)

56 patterns found

• YARA Match: process.env.; process.env.; process.env.; curl -X POST; ngrok.io; ngrok.iocritical · concepts/webhooks.md:29 · YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
• YARA Match: process.env.; process.env.; process.env.; process.env.; process.env.; process.env.; process.env.; fetch(; fetch(; ngrok.io; ngrok.iocritical · examples/chatbot-setup.md:67 · YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
• YARA Match: process.env.; process.env.; fetch(; fetch(; fetch(; fetch(; ngrok.iocritical · references/full-guide.md:121 · YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
• analysis-evasion: references/full-guide.md (partial)high · SKILL.md:21 · Referenced artifact was not completely inspected
• analysis-evasion: examples/chatbot-setup.md (partial)high · SKILL.md:26 · Referenced artifact was not completely inspected
• analysis-evasion: troubleshooting/common-issues.md (partial)high · SKILL.md:27 · Referenced artifact was not completely inspected
• Privilege Escalation: access tokenhigh · concepts/api-selection.md:144 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: access tokenhigh · concepts/api-selection.md:147 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: access tokenhigh · concepts/api-selection.md:170 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: access tokenhigh · concepts/authentication.md:32 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Structure

• Description is very shortA description that says when to use the skill helps agents route to it.
• No license declaredConfirm you may reuse this skill before importing it into your repository.

SKILL.md

---
name: build-zoom-team-chat-app
description: Use when building Team Chat.
---

# Build Zoom Team Chat App

Use this skill when the target surface is Zoom Team Chat. First decide whether the integration is user-scoped messaging, a chatbot, an interactive message-card workflow, or a webhook-driven automation.

## Workflow

1. Choose the API surface: Team Chat API for user-scoped actions, Chatbot API for bot identity and chatbot workflows.
2. Confirm app type, scopes, role enablement, and whether the account has Zoom for Developers enabled.
3. Model message structure before coding: plain messages, rich cards, buttons, dropdowns, forms, slash commands, and threaded replies.
4. Implement OAuth and token refresh separately from message sending, with clear storage boundaries.
5. Add webhook handlers for interactivity and lifecycle events with signature verification and retry-safe processing.
6. Debug by checking JID formats, channel membership, bot installation, scopes, role settings, and message-card payload shape.

## References

- Full preserved guide: [references/full-guide.md](references/full-guide.md)
- API selection: [concepts/api-selection.md](concepts/api-selection.md)
- Message structure: [concepts/message-structure.md](concepts/message-structure.md)
- Message cards: [references/message-cards.md](references/message-cards.md)
- Scopes: [references/scopes.md](references/scopes.md)
- Chatbot setup: [examples/chatbot-setup.md](examples/chatbot-setup.md)
- Common issues: [troubleshooting/common-issues.md](troubleshooting/common-issues.md)