100Critical
The skill contains hardcoded credentials, lacks necessary tool and network constraints, uses insecure dependency management, and references missing documentation, creating significant security and supply chain risks.
HygienePackaging & Manifest6 findings
Skill Info
Nameanthropics/knowledge-work-plugins/zoom-cobrowse-sdk
Registrygithub
Version4fc672a0eb8b
PURLpkg:github/anthropics/knowledge-work-plugins@4fc672a0eb8b?skill=zoom-cobrowse-sdk
Stars22,195
Installs1,100
Source
Install
This skill has been flagged as potentially malicious. Review the findings below before installing.
GitHub
1,100 installs
Skills.shDocs
npx skills add https://github.com/anthropics/knowledge-work-pluginsAssessments (3)
AI Agent Traps ↗Hardcoded credentials detected. Passwords, API keys, and secrets should not be hardcoded in source code. Use environment variables or a secrets manager instead.criticalvulnAML.T0055AML.T0037LLM02:2025
Hardcoded credentials detected. Passwords, API keys, and secrets should not be hardcoded in source code. Use environment variables or a secrets manager instead.
95% confidenceline 10
"token": "eyJhbGciOiJIUzI1NiIs..."
Unverified dependency installation patternmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
The skill provides instructions to run 'npm install' without version pinning, which could lead to the execution of compromised or malicious package versions. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
90% confidenceline 169
git clone https://github.com/zoom/cobrowsesdk-auth-endpoint-sample.git; cd cobrowsesdk-auth-endpoint-sample; npm install
Outbound network request primitive in skill code — can transmit data externallylowdata exfiltrationAML.T0025AML.T0024LLM02:2025
Outbound network request primitive in skill code — can transmit data externally
95% confidenceline 5
fetch('/api/token', {
method: 'POST',
body: JSON.stringify({ role: 1, userId, userName })
})Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "concepts/jwt-authentication.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[JWT Authentication](concepts/jwt-authentication.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "concepts/session-lifecycle.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[Session Lifecycle](concepts/session-lifecycle.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "examples/agent-integration.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[Agent Integration](examples/agent-integration.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "examples/customer-integration.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[Customer Integration](examples/customer-integration.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "get-started.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[Get Started Guide](get-started.md)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (2)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/anthropics/knowledge-work-plugins/zoom-cobrowse-sdk)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/anthropics/knowledge-work-plugins/zoom-cobrowse-sdk"><img src="https://mondoo.com/ai-agent-security/api/badge/github/anthropics/knowledge-work-plugins/zoom-cobrowse-sdk.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/anthropics/knowledge-work-plugins/zoom-cobrowse-sdk.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow