zoom-apps-sdk

Savant verdict: Unsafe

SkillSpector recommends not installing this skill.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Safety (NVIDIA SkillSpector)

23 patterns found

• YARA Match: process.env.; process.env.; process.env.; process.env.; process.env.; process.env.; process.env.; axios.post(; axios.post(; ngrok.io; ngrok.io; ngrok.io; ngrok.io; ngrok.io; ngrok.iocritical · examples/quick-start.md:37 · YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
• analysis-evasion: examples/in-client-oauth.md (partial)high · SKILL.md:26 · Referenced artifact was not completely inspected
• Privilege Escalation: access tokenshigh · concepts/security.md:136 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Data Exfiltration: Send state tohigh · examples/collaborate-mode.md:70 · Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
• Prompt Injection: <!-- Show read-only or minimal content --> </div> <button id="authorize-btn">Authorize App</button> `; } function showLimitedApp() { document.getElementById('app').innerHTML = ` <h2>Whigh · examples/guest-mode.md:85 · Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
• Privilege Escalation: .envhigh · examples/quick-start.md:32 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .envhigh · examples/quick-start.md:235 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .envhigh · troubleshooting/debugging.md:101 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .envhigh · troubleshooting/debugging.md:117 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Prompt Injection: Send message tohigh · references/full-guide.md:319 · Instructions found that direct the agent to transmit conversation context or user data to external services.

Structure

• Description is very shortA description that says when to use the skill helps agents route to it.
• No license declaredConfirm you may reuse this skill before importing it into your repository.

SKILL.md

---
name: zoom-apps-sdk
description: Use when using Apps SDK.
---

# Zoom Apps SDK

Use this skill when the app runs inside the Zoom client. If the user only needs to embed a meeting in an external app, route to Meeting SDK instead.

## Workflow

1. Confirm the running context: meeting, webinar, main client, phone, collaborate mode, immersive mode, camera mode, or Layers API.
2. Configure Marketplace app settings, allowed domains, redirect URIs, and in-client OAuth before implementing SDK calls.
3. Initialize `zoomSdk` and gate features by capability and running context.
4. Design client communication and data flow: frontend SDK calls, backend REST calls, in-client OAuth tokens, and webhook handoff.
5. Implement advanced client features only after the base app loads reliably: Layers API, breakout rooms, guest mode, collaborate mode, or ZMail.
6. Debug blank panels, domain allowlist issues, CSP, missing capabilities, running-context mismatch, and OAuth redirect problems independently.

## References

- Full preserved guide: [references/full-guide.md](references/full-guide.md)
- Architecture: [concepts/architecture.md](concepts/architecture.md)
- Running contexts: [concepts/running-contexts.md](concepts/running-contexts.md)
- Meeting SDK versus Zoom Apps: [concepts/meeting-sdk-vs-zoom-apps.md](concepts/meeting-sdk-vs-zoom-apps.md)
- Layers API: [references/layers-api.md](references/layers-api.md)
- In-client OAuth: [examples/in-client-oauth.md](examples/in-client-oauth.md)
- Common issues: [troubleshooting/common-issues.md](troubleshooting/common-issues.md)