Skill Vexa

Send bots to Zoom, Google Meet, and Microsoft Teams meetings. Get live transcripts, recordings, and reports. Works with Vexa Cloud or your own self-hosted in...

Before installing: 1) Note the manifest omission — this skill requires a VEXA_API_KEY (set in env or skills/vexa/secrets/vexa.env). Don't paste API keys into chat; follow the onboarding flow and persist keys in a secrets file with proper file permissions. 2) The skill's scripts read local OpenClaw files (openclaw.json, sessions.json) and may inspect ~/.cloudflared credentials to validate webhooks — these files can contain tokens or sensitive config. Only install if you trust the skill source and are comfortable it can read those files. 3) The skill will write reports into your workspace (memory/meetings/) and can persist state under skills/vexa/secrets/. Ensure those paths are excluded from version control and review their contents after use. 4) Consider testing in an isolated environment (throwaway workspace or VM) first, and review the bundled scripts (which are included) to confirm behavior you are comfortable with. 5) If you want to proceed but reduce exposure: set VEXA_API_KEY only in environment (not in skill secrets), avoid enabling public webhook tunnels until you verify security, and verify openclaw.json and sessions.json contents before allowing the skill to read them. If you need the skill for production use, ask the author to fix the registry metadata (declare required env) and to document precisely what local files the scripts will read and why.

Type: OpenClaw Skill Name: vexa Version: 0.1.3 The Vexa skill bundle is a legitimate integration for managing meeting bots on platforms like Zoom, Google Meet, and Microsoft Teams. The code provides functional CLI tools (vexa.mjs, ingest.mjs, onboard.mjs) for starting bots, retrieving transcripts, and generating meeting reports. Security best practices are implemented, including the use of 'chmod 600' for local secret files, mandatory confirmation flags for destructive 'DELETE' operations, and explicit instructions in SKILL.md and onboarding-flow.md directing the AI agent never to ask users for API keys in chat. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.