zoom-mcp
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is composed of markdown documentation and configuration guidance for official Zoom MCP services hosted at mcp-us.zoom.us. No executable scripts, binaries, or code files are included in the package.
- [PROMPT_INJECTION]: The tools defined in the skill for retrieving meeting transcripts and summaries create an attack surface for indirect prompt injection.
- Ingestion points: External meeting data is brought into the agent's context through tools like
search_meetings,get_meeting_assets, andget_recording_resource(specified in SKILL.md and references/tools.md). - Boundary markers: The documentation does not specify boundary markers or instructions for the agent to ignore embedded commands within the retrieved meeting content.
- Capability inventory: The skill enables agents to perform semantic searches across meeting history and create new Zoom Docs using retrieved content (examples/create-zoom-doc.md).
- Sanitization: There is no guidance provided for sanitizing, filtering, or validating the meeting content before it is processed by the agent.
Audit Metadata