zoom-rtms

Savant verdict: Unsafe

SkillSpector recommends not installing this skill.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Safety (NVIDIA SkillSpector)

11 patterns found

• analysis-evasion: references/full-guide.md (partial)high · SKILL.md:21 · Referenced artifact was not completely inspected
• analysis-evasion: concepts/connection-architecture.md (partial)high · SKILL.md:22 · Referenced artifact was not completely inspected
• analysis-evasion: concepts/lifecycle-flow.md (partial)high · SKILL.md:23 · Referenced artifact was not completely inspected
• analysis-evasion: references/media-types.md (partial)high · SKILL.md:24 · Referenced artifact was not completely inspected
• analysis-evasion: examples/rtms-bot.md (partial)high · SKILL.md:26 · Referenced artifact was not completely inspected
• Privilege Escalation: .envhigh · examples/sdk-quickstart.md:15 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .envhigh · references/quickstart.md:15 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Data Exfiltration: fetch('https://api.openai.com/v1/chat/completions', { method: 'POST'medium · examples/ai-integration.md:233 · Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
• Data Exfiltration: https://api.openai.com/medium · examples/ai-integration.md:233 · Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
• Data Exfiltration: curl -X POST "https://api.zoom.us/v2/meetings/{meetingId}/rtms" \ -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -dmedium · examples/rtms-bot.md:183 · Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Structure

• Description is very shortA description that says when to use the skill helps agents route to it.
• No license declaredConfirm you may reuse this skill before importing it into your repository.

SKILL.md

---
name: zoom-rtms
description: Use when using RTMS.
---

# Zoom Realtime Media Streams

Use this skill when the integration needs real-time meeting or contact-center media as a backend stream. If the workflow needs a visible participant bot, compare against `build-zoom-bot` and `zoom-meeting-sdk-linux` before choosing RTMS.

## Workflow

1. Confirm the source surface: Meetings RTMS, Contact Center voice media, or another documented RTMS stream.
2. Decide whether RTMS is sufficient or whether a Meeting SDK bot is required for participant identity, meeting controls, or UI-visible behavior.
3. Implement the WebSocket lifecycle first: event subscription, connection validation, media start, heartbeat, reconnect, and shutdown.
4. Process media types intentionally: audio, video, screen share, chat, live transcript, and metadata have different payload and timing constraints.
5. Design downstream pipelines for buffering, transcription, AI analysis, recording, or tool invocation.
6. Debug by isolating app setup, webhook/event delivery, stream authorization, network connectivity, and media payload decoding.

## References

- Full preserved guide: [references/full-guide.md](references/full-guide.md)
- Connection architecture: [concepts/connection-architecture.md](concepts/connection-architecture.md)
- Lifecycle flow: [concepts/lifecycle-flow.md](concepts/lifecycle-flow.md)
- Media types: [references/media-types.md](references/media-types.md)
- Data types: [references/data-types.md](references/data-types.md)
- RTMS bot example: [examples/rtms-bot.md](examples/rtms-bot.md)
- Common issues: [troubleshooting/common-issues.md](troubleshooting/common-issues.md)