Security audit

zoom-meeting-admin

Security checks across malware telemetry and agentic risk

Overview

This Zoom administration skill is powerful but its credential use, Zoom API calls, token cache, and destructive meeting deletion capability are disclosed and aligned with its stated purpose.

Install only if you are comfortable giving the agent access to a dedicated Zoom Server-to-Server OAuth app. Use the minimum Zoom scopes, avoid enabling delete or recording scopes unless needed, keep .env and ~/.zoom-s2s-token.json private, and manually verify meeting details before approving any deletion.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation states deletion must require a --yes flag, but the core script example shows delete_meeting without it. That inconsistency can cause agents or users to invoke deletion unsafely or normalize a destructive workflow without the intended guardrail and explicit confirmation path.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The script’s documented safety model says deletion should be preceded by displaying the meeting details and obtaining confirmation, but the implementation only checks for the presence of --yes and immediately deletes the supplied meeting ID. In an agent setting, this mismatch weakens a destructive-action safeguard and makes accidental or misdirected deletion more likely, especially if the caller passes the wrong ID or the user never sees what is being deleted.

External Transmission

Medium

Category: Data Exfiltration
Content: 本 Skill 通过 `scripts/zoom-s2s.py` 调用 Zoom Server-to-Server OAuth REST API，不实现"通用 REST 代理"。 - **声明的工具**：`Bash(python3:*)`（执行 `scripts/zoom-s2s.py`）、`Bash(ls:*)` / `Bash(cat:*)`（查看脚本输出与缓存）、`Read`（读取凭证文件与文档）。 - **网络访问**：向 `https://zoom.us/oauth/token` 与 `https://api.zoom.us/v2/*` 发起 HTTPS 请求，传输头包含 `Authorization: Bearer <token>`。 - **文件写入**：在 `~/.zoom-s2s-token.json` 缓存访问令牌（已自动 `chmod 600`）。 - **凭证读取**：从仓库根目录的 `.env` 读取 `ZOOM_ACCOUNT_ID` / `ZOOM_CLIENT_ID` / `ZOOM_CLIENT_SECRET` / `ZOOM_USER_ID`。 - **允许的 Action（白名单）**——禁止构造任意 Zoom REST 请求或调用未列出的端点：
Confidence: 91% confidence
Finding: This skill intentionally transmits account-level OAuth credentials-derived tokens and sensitive Zoom metadata to external services. In context, that is core functionality, but it still creates real exposure because the credentials can access all meetings, recordings, and destructive operations at the account level if misused or intercepted through surrounding tooling/logging.

Credential Access

High

Category: Privilege Escalation
Content: --- name: zoom-meeting-admin allowed-tools: Bash(python3:*) Bash(ls:*) Bash(cat:*) Read compatibility: Requires Python 3.7+, network access to zoom.us and api.zoom.us, and a local .env with Zoom Server-to-Server OAuth credentials. description: Manage Zoom meetings, cloud recordings, and account users via a Server-to-Server OAuth REST script. Use this skill when the user wants to list, view, create, or delete a scheduled Zoom meeting; query cloud recordings for a user; or look up account users. The script exposes a fixed CLI action whitelist (list/get/create/delete meeting, get/list user, list recordings); agents must only invoke these documented actions and must not modify the script, import internal functions, or construct arbitrary Zoom API requests. create_meeting requires the agent to obtain explicit user confirmation of topic, start_time, and duration before invoking. delete_meeting is gated by a required --yes flag and the agent must display the meeting info and obtain explicit user confirmation before invoking. Requires a Zoom Server-to-Server OAuth app and a local .env with ACCOUNT_ID, CLIENT_ID, CLIENT_SECRET, USER_ID. ---
Confidence: 95% confidence
Finding: The skill explicitly depends on reading long-lived account-level secrets from a local .env file. In this context that is necessary to function, but it is still a real credential-exposure risk because these secrets can mint account-wide access tokens and enable reading recordings, listing users, creating meetings, and deleting meetings.

Credential Access

High

Category: Privilege Escalation
Content: name: zoom-meeting-admin allowed-tools: Bash(python3:*) Bash(ls:*) Bash(cat:*) Read compatibility: Requires Python 3.7+, network access to zoom.us and api.zoom.us, and a local .env with Zoom Server-to-Server OAuth credentials. description: Manage Zoom meetings, cloud recordings, and account users via a Server-to-Server OAuth REST script. Use this skill when the user wants to list, view, create, or delete a scheduled Zoom meeting; query cloud recordings for a user; or look up account users. The script exposes a fixed CLI action whitelist (list/get/create/delete meeting, get/list user, list recordings); agents must only invoke these documented actions and must not modify the script, import internal functions, or construct arbitrary Zoom API requests. create_meeting requires the agent to obtain explicit user confirmation of topic, start_time, and duration before invoking. delete_meeting is gated by a required --yes flag and the agent must display the meeting info and obtain explicit user confirmation before invoking. Requires a Zoom Server-to-Server OAuth app and a local .env with ACCOUNT_ID, CLIENT_ID, CLIENT_SECRET, USER_ID. --- > ⚠️ **安全提示 — 凭证等同于账户管理员口令**
Confidence: 95% confidence
Finding: The description reiterates reliance on a local .env containing account credentials and makes clear the skill operates with powerful OAuth material. Because the credential context is highly privileged, any accidental disclosure through tools, logs, or agent behavior would have broad account impact.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.