The materials explicitly state 'required secrets/environment variables: none'; as a prompt-only skill, it does not itself request API keys, tokens, or environment variables. The README mentions 'tokenized join' as part of the Zoom SDK use case, but that does not mean this skill itself collects or stores credentials.

No remote endpoints are declared, and the system checks found no configured network hosts. The README only links to Zoom's official documentation and API reference sites, which is documentation referencing rather than data exfiltration by the skill itself.

The system has classified it as prompt-only; the materials do not describe installation scripts, command execution, local process launching, or system capability invocation. The description targets 'building macOS video session apps,' but the current skill text itself contains no executable logic.

The materials do not declare any ability to read or write local files, media devices, contacts, or other user data. Although Zoom Video SDK scenarios typically involve camera/microphone access, that is a permission issue at the upstream SDK/application integration layer, not data access already granted to this documentation-style skill itself.

Positive factors: it is open source on GitHub and auditable, and the repository is under anthropics/knowledge-work-plugins. Caution points: no declared license, 0 stars, unknown maintenance status, and the content mainly points to external Zoom docs and the upstream SDK, so part of the real security posture depends on those external dependencies.