scribe
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- Authentication and Credential Management: The skill correctly emphasizes the use of environment variables for managing sensitive API keys and secrets (
ZOOM_API_KEY,ZOOM_API_SECRET,AWS_ACCESS_KEY_ID). It provides Node.js implementation examples for generating short-lived HS256 JWT tokens, adhering to the principle of least-privilege for session duration. - Webhook Security Verification: Documentation and code snippets are provided for verifying Zoom webhook signatures using HMAC-SHA256 with a shared secret. This is a robust practice to ensure that incoming data is authentic and has not been tampered with by external parties.
- Data Processing Boundaries: The skill is designed to handle media file transcription workflows. It provides clear guidance on processing uploaded files and stored archives, including the use of pre-signed URLs or temporary AWS credentials to limit storage access scope.
- Trusted External References: All referenced external resources, including documentation and code samples, originate from the official Zoom developer portal or the authenticated Zoom GitHub repository, which are trusted environments for this skill's context.
Audit Metadata