The material explicitly states there are no keys or environment variables. As a documentation-style skill, it does not appear to require API tokens, account credentials, or sensitive local configuration, so credential exposure is low.

The docs describe loading a campaign URL in WKWebView and routing links in-app, via SFSafariViewController, or to the system browser. No concrete hosts are listed and the skill itself declares no fixed remote endpoints, but real integration will send user interactions to the loaded Zoom/business pages, so URL origins and redirect scope should be verified.

The material mentions injecting `window.zoomCampaignSdkConfig` via WKUserScript, registering message handlers, and keeping `openURL` fallback support; these are typical WebView integration capabilities. There is no indication of arbitrary local code execution or unrelated process spawning, but script injection and bridge handlers should be constrained to trusted page contexts.

There is no declared access to local files, contacts, photos, or other broad device data. However, message handlers, support_handoff relay, and WebView page interactions may carry session content or user input. The material does not show overbroad authorization, but implementations should minimize bridged data and URL handling scope.

The source is an open-source GitHub repository, which is more auditable than closed materials; the system also classifies it as prompt-only/open-source. Downsides include 0 stars, no declared license, and unknown maintenance status, but absent malicious endpoints, obfuscated releases, or distorted install instructions, overall supply-chain risk remains low.