setup-zoom-websockets
The skill insecurely exposes access tokens in URLs, lacks necessary security constraints for network and tool access, and contains broken documentation references that obscure its operational behavior.
Skill Info
Install
npx skills add https://github.com/anthropics/knowledge-work-pluginsAssessments (3)
AI Agent Traps ↗The code constructs a WebSocket URL by embedding the access token directly as a query parameter. This token will be logged in plain text in server logs, proxy logs, and browser history, facilitating credential theft.
const wsUrl = `wss://ws.zoom.us/ws?subscriptionId=${SUBSCRIPTION_ID}&access_token=${accessToken}`;The event handler blindly trusts the structure of the incoming WebSocket message, which could lead to prototype pollution or unexpected behavior if the payload is manipulated by a malicious actor or compromised Zoom endpoint.
const event = JSON.parse(data); switch (event.event) { ... }SKILL.md links to "RUNBOOK.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[5-Minute Runbook](RUNBOOK.md)
SKILL.md links to "references/connection.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[references/connection.md](references/connection.md)
SKILL.md links to "references/environment-variables.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[references/environment-variables.md](references/environment-variables.md)
SKILL.md links to "references/events.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[references/events.md](references/events.md)
SKILL.md links to "troubleshooting/common-issues.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[troubleshooting/common-issues.md](troubleshooting/common-issues.md)
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Version History (2)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/anthropics/knowledge-work-plugins/setup-zoom-websockets)<a href="https://mondoo.com/ai-agent-security/skills/github/anthropics/knowledge-work-plugins/setup-zoom-websockets"><img src="https://mondoo.com/ai-agent-security/api/badge/github/anthropics/knowledge-work-plugins/setup-zoom-websockets.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/anthropics/knowledge-work-plugins/setup-zoom-websockets.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow