zoom-cobrowse-sdk

Savant verdict: Unsafe

SkillSpector recommends not installing this skill.

Live evaluation

Not evaluated yet. Workspaces can request a live evaluation.

Safety (NVIDIA SkillSpector)

10 patterns found

• analysis-evasion: references/full-guide.md (partial)high · SKILL.md:21 · Referenced artifact was not completely inspected
• Privilege Escalation: .envhigh · get-started.md:122 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .envhigh · get-started.md:123 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .envhigh · references/full-guide.md:160 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Privilege Escalation: .envhigh · references/full-guide.md:161 · Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
• Data Exfiltration: fetch('https://your_token_service_base_url', { method: 'POST'medium · get-started.md:223 · Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
• Data Exfiltration: fetch("https://your_token_service_base_url", { method: "POST"medium · get-started.md:306 · Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
• Data Exfiltration: fetch("https://your_token_service_base_url", { method: "POST"medium · get-started.md:354 · Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
• Data Exfiltration: fetch("https://your_token_service_base_url", { method: "POST"medium · references/full-guide.md:257 · Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
• Data Exfiltration: fetch("https://your_token_service_base_url", { method: "POST"medium · references/full-guide.md:296 · Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Structure

• Description is very shortA description that says when to use the skill helps agents route to it.
• No license declaredConfirm you may reuse this skill before importing it into your repository.

SKILL.md

---
name: zoom-cobrowse-sdk
description: Use when using Cobrowse.
---

# Zoom Cobrowse SDK

Use this skill after the support workflow is clearly a browser co-browsing experience. If the user is still choosing between Zoom Contact Center, Virtual Agent, Video SDK, or Cobrowse, route through `start` or `plan-zoom-product` first.

## Workflow

1. Confirm the role model: customer page, agent console, session initiation, and how the PIN or link is handed off.
2. Check auth and session setup before UI work: tokens, allowed origins, environment variables, and SDK loading.
3. Design privacy controls early: masking rules, blocked elements, remote-assist permission boundaries, and audit requirements.
4. Implement the minimal lifecycle first: initialize, start or join, subscribe to events, reconnect, and end.
5. Add advanced capabilities only after the base session is stable: annotations, multi-tab persistence, custom PINs, and remote assist.
6. When debugging, isolate browser support, CORS/CSP, token generation, third-party cookie behavior, and SDK event errors.

## References

- Full preserved guide: [references/full-guide.md](references/full-guide.md)
- API reference: [references/api-reference.md](references/api-reference.md)
- Session lifecycle: [concepts/session-lifecycle.md](concepts/session-lifecycle.md)
- Privacy masking: [examples/privacy-masking.md](examples/privacy-masking.md)
- Remote assist: [examples/remote-assist.md](examples/remote-assist.md)
- Common issues: [troubleshooting/common-issues.md](troubleshooting/common-issues.md)