anthropics/knowledge-work-plugins zoom-apps-sdk
Checked the catalogued skill at zoom-apps-sdk.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →
B; retained sample includes a medium finding · SD-007 · what this rule accepts as a false positive →
19 suppressed by AI triage
The curl command is part of a documentation snippet used for testing connectivity, not actual execution; thus it represents a benign example.
The curl command is in a documentation block for validating URLs, not a malicious or exfiltrating operation; hence benign.
The curl command demonstrates expected API calls in documentation, not a threat; it is a benign example.
The fetch call is to a relative internal API endpoint, not to an external host.
fetch to relative API endpoint is an internal network call, not an exfiltration or external payload fetch
Documentation example code, no malicious intent.
Documentation example code, no malicious intent.
Documentation example code, no malicious intent.
Reference link in documentation, not an actual file read/write.
Relative link in documentation, not used at runtime.
The path refers to a relative link in documentation, not executable code.
The path is a documentation reference link, not code that accesses the filesystem.
The '../examples/...' link is a documentation reference, not executable code, so no path traversal risk.
Same as above, documentation link, not a threat.
Example fetch to internal API in documentation.
Example fetch to internal API in documentation.
Relative path reference in documentation, not actual code.
Relative path reference in documentation, not actual code.
The file is documentation only and contains no actual outbound network calls or permission grants.