build-zoom-team-chat-app

The provided webhook verification example uses string concatenation to build the message for HMAC validation, which can be vulnerable to timing attacks or canonicalization issues if not handled strictly. [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]

const message = `v0:${req.headers['x-zm-request-timestamp']}:${JSON.stringify(req.body)}`;

Environment secret flows to a network sink (JS/TS) [severity raised to high: this vector is independently flagged by both deterministic and LLM analysis (ADR-0065 corroboration).]

taint source (line 27): process.env.ZOOM_BOT_JID → sink: fetch('https://api.zoom.us/v2/im/chat/messages', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    robot_jid: process.env.ZOOM_BOT_JID,
    to_jid: payload.toJid,           // From webhook
    account_id: payload.accountId,   // From webhook
    content: {
      head: {
        text: 'Build Notification',
        sub_head: { text: 'CI/CD Pipeline' }
      },
      body: [
        { type: 'message', text: 'Deployment successful!' },
        {
          type: 'fields',
          items: [
            { key: 'Branch', value: 'main' },
            { key: 'Commit', value: 'abc123' }
          ]
        },
        {
          type: 'actions',
          items: [
            { text: 'View Logs', value: 'view_logs', style: 'Primary' },
            { text: 'Dismiss', value: 'dismiss', style: 'Default' }
          ]
        }
      ]
    }
  })
})

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

SKILL.md links to "concepts/api-selection.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Choose Your API](concepts/api-selection.md)

SKILL.md links to "concepts/environment-setup.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Environment Setup](concepts/environment-setup.md)

SKILL.md links to "examples/oauth-setup.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[OAuth Setup](examples/oauth-setup.md)

SKILL.md links to "examples/send-message.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Send First Message](examples/send-message.md)

SKILL.md links to "get-started.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Get Started](get-started.md)