zoom-meeting-sdk

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The Linux Meeting SDK docs and bot workflows (e.g., linux/SKILL.md, linux/meeting-sdk-bot.md and linux/concepts/high-level-scenarios.md) explicitly show subscribing to raw meeting audio/video and in-meeting chat, streaming transcripts to external transcription/AI services (AssemblyAI/Anthropic) and using AI-extracted action items to send chat or take actions, so untrusted user-generated meeting content is ingested and can materially influence agent behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The Quick Start uses CDN-hosted scripts that are fetched and executed at runtime (e.g., https://source.zoom.us/6.0.0/zoom-meeting-6.0.0.min.js and its vendor libs), which means remote code is loaded and executed as a required dependency for the Client View flow.