Security audit

zoom-meeting-admin

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Zoom administration helper that handles sensitive account credentials and meeting data, but its behavior is purpose-aligned and bounded to documented Zoom actions.

Install only if you are comfortable granting a dedicated Zoom Server-to-Server OAuth app access to the needed meeting, user, and recording scopes. Keep .env out of sync tools and repositories, use minimum Zoom scopes, avoid shared machines, and do not enable deletion or recording access unless you actually need them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .env.sample (reported line 4)May include surrounding context.
text
.env .DS_Store __pycache__ .pyc

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 1)May include surrounding context.
text
.env .DS_Store __pycache__ .pyc

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 18)May include surrounding context.
md
## Credentials > ⚠️ **The `ZOOM_CLIENT_SECRET` in `.env` is equivalent to an account-admin password.** Anyone holding the `ACCOUNT_ID + CLIENT_ID + CLIENT_SECRET` triple can mint a 1-hour account-level access token that reads all meeting metadata, cloud recordings, and can delete meetings. > > - Never commit `.env` to git. Confirm your IDE, backup tools, and file-sync services (iCloud / Dropbox / OneDrive / Nutstore) are not auto-uploading it. > - `chmod 600 .env`. The token cache at `~/.zoom-s2s-token.json` is auto-set to `chmod 600` by the script.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 24)May include surrounding context.
md
> - `chmod 600 .env`. The token cache at `~/.zoom-s2s-token.json` is auto-set to `chmod 600` by the script. > - Use the **minimum scopes** you actually need (see table below). Do not enable `meeting:write:delete`, `cloud_recording:read:*`, or `user:read:list_users` unless required. > - Create a **dedicated** Server-to-Server App for this skill — do not reuse credentials from other business apps. > - If leaked: delete the App in Zoom Marketplace → re-create and rotate all four values → `rm -f ~/.zoom-s2s-token.json`. Edit the `.env` file with your Zoom Server-to-Server OAuth App credentials:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.zh-cn.md (reported line 24)May include surrounding context.
md
> - `chmod 600 .env`。脚本缓存的 token 文件 `~/.zoom-s2s-token.json` 由脚本自动 `chmod 600`。 > - **按需开通最小 scope**（见下表）。未用到的功能不要勾选对应权限；不要轻易开启 `meeting:write:delete`、`cloud_recording:read:*`、`user:read:list_users`。 > - 为本 Skill **单独创建一个** Server-to-Server App，不要复用其他业务 App 的凭据。 > - 一旦泄露：在 Zoom Marketplace 删除该 App → 重新创建并轮换四项值 → `rm -f ~/.zoom-s2s-token.json` 强制重新认证。编辑 `.env` 文件，填入你的 Zoom Server-to-Server OAuth App 凭证：

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
md
> - `chmod 600 .env`。脚本缓存的 token 文件 `~/.zoom-s2s-token.json` 由脚本自动 `chmod 600`。 > - **按需开通最小 scope**（见下表）。未用到的功能不要勾选对应权限；不要轻易开启 `meeting:write:delete`、`cloud_recording:read:*`、`user:read:list_users`。 > - 为本 Skill **单独创建一个** Server-to-Server App，不要复用其他业务 App 的凭据。 > - 一旦泄露：在 Zoom Marketplace 删除该 App → 重新创建并轮换四项值 → `rm -f ~/.zoom-s2s-token.json` 强制重新认证。编辑 `.env` 文件，填入你的 Zoom Server-to-Server OAuth App 凭证：

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 71)May include surrounding context.
zoom-s2s-oauth/ ├── SKILL.md # AI Agent 调用说明 ├── README.md # 本文件 ├── .env # 凭证配置 (不要提交到 git!) └── scripts/ └── zoom-s2s.py # 主脚本 (纯 Python3，无外部依赖)

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.zh-cn.md (reported line 70)May include surrounding context.
zoom-s2s-oauth/ ├── SKILL.md # AI Agent 调用说明 ├── README.md # 本文件 ├── .env # 凭证配置 (不要提交到 git!) └── scripts/ └── zoom-s2s.py # 主脚本 (纯 Python3，无外部依赖)

text

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill is explicitly designed to read long-lived Server-to-Server OAuth credentials from a local .env, and the document states these are effectively equivalent to an account administrator password. If the skill, its outputs, logs, or surrounding agent workflow mishandle these values, an attacker could obtain account-wide access to meetings, recordings, and destructive operations.
Content: Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.
md
name: zoom-meeting-admin allowed-tools: Bash(python3 zoom-s2s.py:*) Read compatibility: Requires Python 3.7+; performs HTTPS calls to zoom.us and api.zoom.us (network); writes a token cache to ~/.zoom-s2s-token.json (auto chmod 600); reads ZOOM_ACCOUNT_ID / ZOOM_CLIENT_ID / ZOOM_CLIENT_SECRET / ZOOM_USER_ID from a local .env. description: List, create, delete, and query Zoom meetings, cloud recordings, and account users via a fixed CLI (scripts/zoom-s2s.py, 7 whitelisted actions) using Server-to-Server OAuth. Use when the user asks to schedule, reschedule, cancel, find, or look up a Zoom meeting; set up a recurring Zoom; pull cloud recordings or past meeting metadata; or look up account users. Triggers on phrases like "Zoom meeting", "zoom 会议", "约 Zoom", "取消 Zoom", "录像", "schedule a Zoom", "cancel the meeting", "who's on the call", "云录制". create_meeting requires explicit confirmation of topic, start_time, duration; delete_meeting requires --yes and visible confirmation. Agent must only invoke the 7 whitelisted CLI actions and must not modify the script, import internals, or call Zoom REST directly. Requires .env with ACCOUNT_ID/CLIENT_ID/CLIENT_SECRET/USER_ID. Documentation is in Chinese; outputs follow. --- > ⚠️ **安全提示 — 凭证等同于账户管理员口令**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
- 会议：`list_meetings` / `get_meeting` / `create_meeting` / `delete_meeting` - 用户：`get_user` / `list_users` - 录像：`recordings` - **越权防护**：脚本内部包含一个 `api_call` 函数供 CLI action 复用，但这是**私有实现细节，不是对外可调用的接口**。Agent 不得通过以下任何方式旁路调用白名单外的 Zoom 端点（如 `DELETE /users/{id}`、`PATCH /accounts/{id}` 等高风险端点）： - 修改 `scripts/zoom-s2s.py`、新增 CLI action、暴露 `api_call`； - `from zoom_s2s import api_call` 或以其他方式直接调用脚本内部函数； - 在调用本 Skill 的同时**另起进程**用相同凭证调任意 Zoom REST API（如 `curl` 直接打 `api.zoom.us`）；

Lp1

High

Category: MCP Least Privilege
Confidence: 98% confidence
Finding: The script makes outbound network requests to Zoom OAuth and API endpoints, but the metadata does not declare network capability. In a skill system, undeclared egress is dangerous because it can transmit user-provided meeting data and account metadata externally without the permission model clearly reflecting that behavior.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 98% confidence
Finding: The script makes outbound network requests to Zoom OAuth and API endpoints, but the metadata does not declare network capability. In a skill system, undeclared egress is dangerous because it can transmit user-provided meeting data and account metadata externally without the permission model clearly reflecting that behavior.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 98% confidence
Finding: The script makes outbound network requests to Zoom OAuth and API endpoints, but the metadata does not declare network capability. In a skill system, undeclared egress is dangerous because it can transmit user-provided meeting data and account metadata externally without the permission model clearly reflecting that behavior.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The script is designed to access credentials from a local .env file containing Zoom account and client secrets. In an agent skill, direct credential access is security-sensitive because compromise of the skill or surrounding environment would expose API credentials capable of managing meetings and reading account data.
Content: Scanner excerpt · scripts/zoom-s2s.py (reported line 21)May include surrounding context.
python
# 配置 # ============================================================================= SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__)) ENV_FILE = os.path.join(SCRIPT_DIR, "..", ".env") TOKEN_CACHE = os.path.expanduser("~/.zoom-s2s-token.json") ZOOM_ACCOUNT_ID = ""

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The load_env function explicitly loads account ID, client ID, client secret, and user ID into process memory from a local file. This is dangerous in shared or weakly isolated environments because secrets become available to the script and any debugging, logging, or compromise affecting the process.
Content: Scanner excerpt · scripts/zoom-s2s.py (reported line 30)May include surrounding context.
python
ZOOM_USER_ID = "" # ============================================================================= # .env 加载 # ============================================================================= def load_env(): global ZOOM_ACCOUNT_ID, ZOOM_CLIENT_ID, ZOOM_CLIENT_SECRET, ZOOM_USER_ID

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Opening and reading the .env file is a concrete credential-access operation, and the file path is predictable relative to the script. In the context of a meeting-administration skill with broad Zoom account powers, plaintext secret retrieval materially increases the blast radius of any local file disclosure or agent misuse.
Content: Scanner excerpt · scripts/zoom-s2s.py (reported line 35)May include surrounding context.
python
def load_env(): global ZOOM_ACCOUNT_ID, ZOOM_CLIENT_ID, ZOOM_CLIENT_SECRET, ZOOM_USER_ID if not os.path.exists(ENV_FILE): print(f"❌ .env 文件不存在: {ENV_FILE}", file=sys.stderr) sys.exit(1) with open(ENV_FILE) as f: for line in f:

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest says the skill must only invoke the fixed CLI in scripts/zoom-s2s.py and must not call Zoom REST directly. README line L03 instead describes the skill as managing Zoom meetings 'REST API directly', which presents a broader and different operational model than the manifest allows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
md
## Setup Steps 1. Log in to https://marketplace.zoom.us/ 2. From the "Develop" dropdown, select "build app" and create an app of type `Server-to-Server OAuth` 3. Add required OAuth Scopes 4. Get the credentials 5. Activate the app

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: zoom-meeting-admin allowed-tools: Bash(python3 zoom-s2s.py:*) Read compatibility: Requires Python 3.7+; performs HTTPS calls to zoom.us and api.zoom.us (network); writes a token cache to ~/.zoom-s2s-token.json (auto chmod 600); reads ZOOM_ACCOUNT_ID / ZOOM_CLIENT_ID / ZOOM_CLIENT_SECRET / ZOOM_USER_ID from a local .env. description: List, create, delete, and query Zoom meetings, cloud recordings, and account users via a fixed CLI (scripts/zoom-s2s.py, 7 whitelisted actions) using Server-to-Server OAuth. Use when the user asks to schedule, reschedule, cancel, find, or look up a Zoom meeting; set up a recurring Zoom; pull cloud recordings or past meeting metadata; or look up account users. Triggers on phrases like "Zoom meeting", "zoom 会议", "约 Zoom", "取消 Zoom", "录像", "schedule a Zoom", "cancel the meeting", "who's on the call", "云录制". create_meeting requires explicit confirmation of topic, start_time, duration; delete_meeting requires --yes and visible confirmation. Agent must only invoke the 7 whitelisted CLI actions and must not modify the script, import internals, or call Zoom REST directly. Requires .env with ACCOUNT_ID/CLIENT_ID/CLIENT_SECRET/USER_ID. Documentation is in Chinese; outputs follow. ---

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
--- name: zoom-meeting-admin allowed-tools: Bash(python3 zoom-s2s.py:*) Read compatibility: Requires Python 3.7+; performs HTTPS calls to zoom.us and api.zoom.us (network); writes a token cache to ~/.zoom-s2s-token.json (auto chmod 600); reads ZOOM_ACCOUNT_ID / ZOOM_CLIENT_ID / ZOOM_CLIENT_SECRET / ZOOM_USER_ID from a local .env. description: List, create, delete, and query Zoom meetings, cloud recordings, and account users via a fixed CLI (scripts/zoom-s2s.py, 7 whitelisted actions) using Server-to-Server OAuth. Use when the user asks to schedule, reschedule, cancel, find, or look up a Zoom meeting; set up a recurring Zoom; pull cloud recordings or past meeting metadata; or look up account users. Triggers on phrases like "Zoom meeting", "zoom 会议", "约 Zoom", "取消 Zoom", "录像", "schedule a Zoom", "cancel the meeting", "who's on the call", "云录制". create_meeting requires explicit confirmation of topic, start_time, duration; delete_meeting requires --yes and visible confirmation. Agent must only invoke the 7 whitelisted CLI actions and must not modify the script, import internals, or call Zoom REST directly. Requires .env with ACCOUNT_ID/CLIENT_ID/CLIENT_SECRET/USER_ID. Documentation is in Chinese; outputs follow. ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description says the skill triggers on phrases like "cancel the meeting" and "who's on the call", which are common expressions that may refer to non-Zoom contexts. Although some examples are Zoom-specific, these broad phrases weaken trigger specificity and could cause unintended invocation.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
md
> 本 Skill 通过 `.env` 中的 `ZOOM_CLIENT_SECRET` 等 Server-to-Server OAuth 凭证访问 Zoom 账户。 > `ACCOUNT_ID + CLIENT_ID + CLIENT_SECRET` 三元组可换取 1 小时有效的账户级访问令牌，**能够读取该账户下所有会议元数据、云录像，并执行删除等破坏性操作**。 > > **使用前请先完整阅读 [`## 凭证安全`](#凭证安全)**，遵守 `.gitignore`、`chmod 600`、最小 scope、专用 App、泄露应急等要求。 > 任何**修改脚本、import 内部函数、构造任意 payload 调用 `api_call`** 的尝试都构成越权，会被本文档明确禁止。 # Zoom Server-to-Server OAuth REST API

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.zh-cn.md (reported line 21)May include surrounding context.
md
> 本 Skill 通过 `.env` 中的 `ZOOM_CLIENT_SECRET` 等 Server-to-Server OAuth 凭证访问 Zoom 账户。 > `ACCOUNT_ID + CLIENT_ID + CLIENT_SECRET` 三元组可换取 1 小时有效的账户级访问令牌，**能够读取该账户下所有会议元数据、云录像，并执行删除等破坏性操作**。 > > **使用前请先完整阅读 [`## 凭证安全`](#凭证安全)**，遵守 `.gitignore`、`chmod 600`、最小 scope、专用 App、泄露应急等要求。 > 任何**修改脚本、import 内部函数、构造任意 payload 调用 `api_call`** 的尝试都构成越权，会被本文档明确禁止。 # Zoom Server-to-Server OAuth REST API

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
> 本 Skill 通过 `.env` 中的 `ZOOM_CLIENT_SECRET` 等 Server-to-Server OAuth 凭证访问 Zoom 账户。 > `ACCOUNT_ID + CLIENT_ID + CLIENT_SECRET` 三元组可换取 1 小时有效的账户级访问令牌，**能够读取该账户下所有会议元数据、云录像，并执行删除等破坏性操作**。 > > **使用前请先完整阅读 [`## 凭证安全`](#凭证安全)**，遵守 `.gitignore`、`chmod 600`、最小 scope、专用 App、泄露应急等要求。 > 任何**修改脚本、import 内部函数、构造任意 payload 调用 `api_call`** 的尝试都构成越权，会被本文档明确禁止。 # Zoom Server-to-Server OAuth REST API

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
> 本 Skill 通过 `.env` 中的 `ZOOM_CLIENT_SECRET` 等 Server-to-Server OAuth 凭证访问 Zoom 账户。 > `ACCOUNT_ID + CLIENT_ID + CLIENT_SECRET` 三元组可换取 1 小时有效的账户级访问令牌，**能够读取该账户下所有会议元数据、云录像，并执行删除等破坏性操作**。 > > **使用前请先完整阅读 [`## 凭证安全`](#凭证安全)**，遵守 `.gitignore`、`chmod 600`、最小 scope、专用 App、泄露应急等要求。 > 任何**修改脚本、import 内部函数、构造任意 payload 调用 `api_call`** 的尝试都构成越权，会被本文档明确禁止。 # Zoom Server-to-Server OAuth REST API

Static analysis

No suspicious patterns detected.