setup-zoom-websockets

The code constructs a WebSocket URL by embedding the access token directly as a query parameter. This token will be logged in plain text in server logs, proxy logs, and browser history, facilitating credential theft.

const wsUrl = `wss://ws.zoom.us/ws?subscriptionId=${SUBSCRIPTION_ID}&access_token=${accessToken}`;

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

SKILL.md links to "RUNBOOK.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[5-Minute Runbook](RUNBOOK.md)

SKILL.md links to "references/connection.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/connection.md](references/connection.md)

SKILL.md links to "references/environment-variables.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/environment-variables.md](references/environment-variables.md)

SKILL.md links to "references/events.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[references/events.md](references/events.md)

SKILL.md links to "troubleshooting/common-issues.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[troubleshooting/common-issues.md](troubleshooting/common-issues.md)