100Critical
The skill executes unsafe dynamic code, performs unauthorized network requests, and lacks necessary documentation, creating significant risks for code injection and unconstrained data exfiltration.
HygienePackaging & Manifest6 findings
Skill Info
Nameanthropics/knowledge-work-plugins/setup-zoom-websockets
Registrygithub
Version4fc672a0eb8b
PURLpkg:github/anthropics/knowledge-work-plugins@4fc672a0eb8b?skill=setup-zoom-websockets
Stars22,195
Installs1,100
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
1,100 installs
Skills.shDocs
npx skills add https://github.com/anthropics/knowledge-work-pluginsAssessments (4)
AI Agent Traps ↗Detected use of eval() or Function() constructor with dynamic input. This can lead to code injection if the input is user-controlled. Avoid eval() entirely. Use JSON.parse() for data deserialization or a safe expression evaluator for computed values.criticalvulnAML.T0011.000LLM03:2025
Detected use of eval() or Function() constructor with dynamic input. This can lead to code injection if the input is user-controlled. Avoid eval() entirely. Use JSON.parse() for data deserialization or a safe expression evaluator for computed values.
95% confidenceline 6
setTimeout(connectWithReconnect, 5000)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "RUNBOOK.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[5-Minute Runbook](RUNBOOK.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/connection.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[references/connection.md](references/connection.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/environment-variables.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[references/environment-variables.md](references/environment-variables.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/events.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[references/events.md](references/events.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "troubleshooting/common-issues.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[troubleshooting/common-issues.md](troubleshooting/common-issues.md)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Outbound network request primitive in skill code — can transmit data externallylowdata exfiltrationAML.T0025AML.T0024LLM02:2025
Outbound network request primitive in skill code — can transmit data externally (seen 2 times in this file at lines 8, 32)
95% confidenceline 8
axios.post(
'https://zoom.us/oauth/token',
new URLSearchParams({
grant_type: 'account_credentials',
account_id: ACCOUNT_ID
}),
{
headers: {
'Authorization': `Basic ${credentials}`,
'Content-Type': 'application/x-www-form-urlencoded'
}
}
)Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/anthropics/knowledge-work-plugins/setup-zoom-websockets)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/anthropics/knowledge-work-plugins/setup-zoom-websockets"><img src="https://mondoo.com/ai-agent-security/api/badge/github/anthropics/knowledge-work-plugins/setup-zoom-websockets.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/anthropics/knowledge-work-plugins/setup-zoom-websockets.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow