Zoom

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.0.6

Overview

This is a coherent Zoom API skill that needs sensitive credentials and can change real Zoom resources, but those capabilities are disclosed and aligned with its purpose.

Install only if you trust Maton to broker OAuth access to Zoom. Keep MATON_API_KEY, meeting start URLs, join links, passwords, and recording download links private, and require a clear preview plus confirmation before deleting meetings, webinars, recordings, or OAuth connections.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The example response and sample code expose meeting access artifacts such as join URLs, start URLs, and passwords without an explicit warning that these values are sensitive and should not be logged or shared. In this skill context, those values can grant meeting access or host privileges, so normalizing their display in examples increases the chance of accidental disclosure.

VirusTotal

64/64 vendors flagged this skill as clean.