build-zoom-team-chat-app

Environment secret flows to a network sink (JS/TS)

taint source (line 27): process.env.ZOOM_BOT_JID → sink: fetch('https://api.zoom.us/v2/im/chat/messages', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    robot_jid: process.env.ZOOM_BOT_JID,
    to_jid: payload.toJid,           // From webhook
    account_id: payload.accountId,   // From webhook
    content: {
      head: {
        text: 'Build Notification',
        sub_head: { text: 'CI/CD Pipeline' }
      },
      body: [
        { type: 'message', text: 'Deployment successful!' },
        {
          type: 'fields',
          items: [
            { key: 'Branch', value: 'main' },
            { key: 'Commit', value: 'abc123' }
          ]
        },
        {
          type: 'actions',
          items: [
            { text: 'View Logs', value: 'view_logs', style: 'Primary' },
            { text: 'Dismiss', value: 'dismiss', style: 'Default' }
          ]
        }
      ]
    }
  })
})

The provided webhook verification example uses string concatenation for the message payload, which can lead to signature bypass if the JSON serialization is non-deterministic or if the input is manipulated. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]

const message = `v0:${req.headers['x-zm-request-timestamp']}:${JSON.stringify(req.body)}`;

The skill encourages users to manage multiple sensitive credentials (Client Secret, Secret Token, Bot JID) in environment variables, which are often logged or exposed in CI/CD environments if not handled with strict secret management.

Required Credentials table in SKILL.md

Outbound network request primitive in skill code — can transmit data externally

fetch('https://api.zoom.us/v2/chat/users/me/messages', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    message: 'Hello from CI/CD pipeline!',
    to_channel: 'CHANNEL_ID'
  })
})

Outbound network request primitive in skill code — can transmit data externally (seen 2 times in this file at lines 7, 20)

fetch('https://zoom.us/oauth/token', {
    method: 'POST',
    headers: {
      'Authorization': `Basic ${credentials}`,
      'Content-Type': 'application/x-www-form-urlencoded'
    },
    body: 'grant_type=client_credentials'
  })

User input is used to construct a URL for a server-side HTTP request. This could allow an attacker to make requests to internal services or cloud metadata endpoints (Server-Side Request Forgery). Validate URLs against an allowlist of permitted hosts and schemes.

taint source (line 27): process.env.ZOOM_BOT_JID → sink: fetch('https://api.zoom.us/v2/im/chat/messages', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    robot_jid: process.env.ZOOM_BOT_JID,
    to_jid: payload.toJid,           // From webhook
    account_id: payload.accountId,   // From webhook
    content: {
      head: {
        text: 'Build Notification',
        sub_head: { text: 'CI/CD Pipeline' }
      },
      body: [
        { type: 'message', text: 'Deployment successful!' },
        {
          type: 'fields',
          items: [
            { key: 'Branch', value: 'main' },
            { key: 'Commit', value: 'abc123' }
          ]
        },
        {
          type: 'actions',
          items: [
            { text: 'View Logs', value: 'view_logs', style: 'Primary' },
            { text: 'Dismiss', value: 'dismiss', style: 'Default' }
          ]
        }
      ]
    }
  })
})

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

SKILL.md links to "concepts/api-selection.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Choose Your API](concepts/api-selection.md)

SKILL.md links to "concepts/environment-setup.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Environment Setup](concepts/environment-setup.md)

SKILL.md links to "examples/oauth-setup.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[OAuth Setup](examples/oauth-setup.md)

SKILL.md links to "examples/send-message.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Send First Message](examples/send-message.md)

SKILL.md links to "get-started.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Get Started](get-started.md)