Skill Vexa

Send bots to Zoom, Google Meet, and Microsoft Teams meetings. Get live transcripts, recordings, and reports. Self-hosted or cloud — no external API needed.

This skill is not internally consistent and has risky secret-handling practices. Key points before installing or using it: - Do not paste any API keys into chat. The onboarding instructions explicitly tell the assistant to write pasted keys to disk automatically; instead, create the secret file yourself (skills/vexa/secrets/vexa.env) with the VEXA_API_KEY and set file mode 600, or set VEXA_API_KEY in your environment. - Treat the bundled secrets files as compromised: the package already contains API keys. If you or your org used those keys, rotate/revoke them immediately and do not trust them. - The skill will read and may modify workspace/system files (openclaw.json, ~/.openclaw/*). Only allow that if you understand and consent to the exact changes (hooks.mappings, transformsDir). Prefer to make those configuration changes yourself rather than granting the assistant write permission. - If you want to test, run the scripts locally in an isolated environment (container or disposable VM) and review the code paths that write files (onboard.mjs, vexa.mjs, ingest.mjs, audit.mjs, vexa-transform.mjs). Confirm network endpoints (VEXA_BASE_URL) and ensure keys are stored securely. - If you don't trust the skill source (homepage unknown, owner unknown), avoid installing it in production. Ask the publisher to remove embedded secrets and to document why the package contains keys and the 'no external API needed' claim. Additional steps that would increase confidence: a) remove bundled credentials from the package, b) update registry metadata to declare VEXA_API_KEY as a required secret, c) change onboarding to ask the user to create the secret file themselves (or supply a secure upload), and d) provide a clear, auditable mechanism for any workspace config changes requiring explicit user approval.

Type: OpenClaw Skill Name: skill-vexa Version: 0.1.1 The skill bundle contains multiple hardcoded API keys within the 'secrets/' directory (vexa.env, vexa-prod.env, vexa-local.env), representing a significant credential leak. Additionally, the instructions in SKILL.md and references/onboarding-flow.md explicitly direct the AI agent to ask users to paste sensitive API keys directly into the chat interface, which is a high-risk pattern for secret exposure. While the functional logic for meeting bot management appears legitimate, the poor handling of secrets and the inclusion of active credentials in the distribution are major security flaws.