zoom-rtms

User input is used to construct a URL for a server-side HTTP request. This could allow an attacker to make requests to internal services or cloud metadata endpoints (Server-Side Request Forgery). Validate URLs against an allowlist of permitted hosts and schemes.

taint source (line 17): req.body → sink: new WebSocket(server_urls)

The skill provides instructions for a webhook handler that processes external payloads to initiate WebSocket connections. If the `server_urls` or `payload` fields are not strictly validated, an attacker could trigger connections to internal infrastructure or arbitrary URLs. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]

const signalingWs = new WebSocket(server_urls);

SKILL.md links to "concepts/connection-architecture.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Connection Architecture](concepts/connection-architecture.md)

SKILL.md links to "examples/manual-websocket.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Manual WebSocket](examples/manual-websocket.md)

SKILL.md links to "examples/rtms-bot.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[RTMS Bot](examples/rtms-bot.md)

SKILL.md links to "examples/sdk-quickstart.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[SDK Quickstart](examples/sdk-quickstart.md)

SKILL.md links to "references/media-types.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

[Media Types](references/media-types.md)