The material lists no required keys or environment variables and does not ask the user for API keys, tokens, or env vars; the README is only a document index. Although the description mentions token-based session auth, the material itself does not expose a credential collection or misuse path.

The system check lists no remote endpoints, and the README only links to Zoom official documentation and API reference pages; it does not describe the skill actively sending user data to unknown third parties. Based on the current material, there is no visible implementation of actual data egress.

This item is classified by the system as prompt-only, meaning it provides documentation/usage guidance rather than executable install scripts or local commands. The material does not ask to start local processes, run shell commands, or invoke privileged system capabilities.

The material does not declare any ability to read or write local files, databases, clipboard, contacts, photos, or similar data sources; the README is only a navigation document. While a real video SDK may involve media and participant data, this material does not show any implementation of excessive permissions or data harvesting.

Positive factors include a GitHub source and open-source status, which improve auditability. However, the repo has 0 stars, no declared license, and unknown maintenance status, and the material mainly wraps external Zoom SDK documentation; supply-chain transparency and maintenance signals are therefore limited, so the repository contents and dependency sources should be verified before adoption.