Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zoom/zoom-plugin/oauthnpx skills add zoom/zoom-plugin --skill oauthgit clone --depth 1 https://github.com/zoom/zoom-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.07689 |
| Opus 5 | $0.00018 | $0.03845 |
| Sonnet 5 | $0.00007 | $0.01538 |
| Haiku 4.5 | $0.00004 | $0.00769 |
Grade A, and why
zoom-oauth scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const response = await axios.post( How it starts
The opening of the file, as written. The whole thing — 905 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Zoom OAuth
Background reference for Zoom auth and token lifecycle behavior. Prefer setup-zoom-oauth first, then use this skill for the exact flow, scope, and error details.
Zoom OAuth
Authentication and authorization for Zoom APIs.
📖 Complete Documentation
For comprehensive guides, production patterns, and troubleshooting, see Integrated Index section below.
Quick navigation:
- 5-Minute Runbook - Preflight checks before deep debugging
- OAuth Flows - Which flow to use and how each works
- Token Lifecycle - Expiration, refresh, and revocation
- Production Examples - Redis caching, MySQL storage, auto-refresh
- Troubleshooting - Error codes 4700-4741
Prerequisites
- Zoom app created in Marketplace
- Client ID and Client Secret
- For S2S OAuth: Account ID
Need to create/select the app first? Use Marketplace app management for API-driven app creation, manifest validation, app type selection, app-owned Marketplace scopes, and credential response shapes before implementing token flows. Use the template selector for S2S, user-managed, admin-managed, and app-owned credential scenarios. Automation services should also inspect the machine-readable template index before selecting an app type.
Four Authorization Use Cases
| Use Case | App Type | Grant Type | Industry Name |
|---|---|---|---|
| Account Authorization | Server-to-Server | account_credentials |
Client Credentials Grant, M2M, Two-legged OAuth |
| User Authorization | General | authorization_code |
Authorization Code Grant, Three-legged OAuth |
| Device Authorization | General | urn:ietf:params:oauth:grant-type:device_code |
Device Authorization Grant (RFC 8628) |
| Client Authorization | General | client_credentials |
Client Credentials Grant (chatbot-scoped) |
What ships with it
21 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- concepts/oauth-flows.md 22 KB
- concepts/pkce.md 14 KB
- concepts/scopes-architecture.md 6.7 KB
- concepts/state-parameter.md 8.1 KB
- concepts/token-lifecycle.md 15 KB
- examples/device-flow.md 371 B
- examples/pkce-implementation.md 379 B
- examples/s2s-oauth-basic.md 375 B
- examples/s2s-oauth-redis.md 6.6 KB
- examples/token-refresh.md 373 B
- examples/user-oauth-basic.md 376 B
- examples/user-oauth-mysql.md 376 B
- references/classic-scopes.md 362 KB
- references/environment-variables.md 863 B
- references/granular-scopes.md 368 KB
- references/oauth-errors.md 4.8 KB
- RUNBOOK.md 3.3 KB
- troubleshooting/common-errors.md 458 B
- troubleshooting/redirect-uri-issues.md 229 B
- troubleshooting/scope-issues.md 222 B
- troubleshooting/token-issues.md 222 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 905 lines · 37 tokens per session scan A f018a0eafdd6
zoom-oauth is a skill published in the GitHub repository zoom/zoom-plugin (7 stars, last pushed 26d ago), licensed MIT. It adds 37 tokens to every session and 7,689 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
agent-host-chat-contributions
Build and review cross-cutting agent-host chat behavior through lifecycle contributions. Use when adding turn lifecycle side effects, prompt or context injection, restored-history transformation, protocol-action observation, or when reviewing changes that add code to AgentSideEffects or AgentService.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.