← 返回 Skills 市场
Skill Vexa
作者
DmitriyG228
· GitHub ↗
· v0.1.3
1288
总下载
2
收藏
2
当前安装
4
版本数
在 OpenClaw 中安装
/install vexa
功能描述
Send bots to Zoom, Google Meet, and Microsoft Teams meetings. Get live transcripts, recordings, and reports. Works with Vexa Cloud or your own self-hosted in...
安全使用建议
Before installing: 1) Note the manifest omission — this skill requires a VEXA_API_KEY (set in env or skills/vexa/secrets/vexa.env). Don't paste API keys into chat; follow the onboarding flow and persist keys in a secrets file with proper file permissions. 2) The skill's scripts read local OpenClaw files (openclaw.json, sessions.json) and may inspect ~/.cloudflared credentials to validate webhooks — these files can contain tokens or sensitive config. Only install if you trust the skill source and are comfortable it can read those files. 3) The skill will write reports into your workspace (memory/meetings/) and can persist state under skills/vexa/secrets/. Ensure those paths are excluded from version control and review their contents after use. 4) Consider testing in an isolated environment (throwaway workspace or VM) first, and review the bundled scripts (which are included) to confirm behavior you are comfortable with. 5) If you want to proceed but reduce exposure: set VEXA_API_KEY only in environment (not in skill secrets), avoid enabling public webhook tunnels until you verify security, and verify openclaw.json and sessions.json contents before allowing the skill to read them. If you need the skill for production use, ask the author to fix the registry metadata (declare required env) and to document precisely what local files the scripts will read and why.
功能分析
Type: OpenClaw Skill
Name: vexa
Version: 0.1.3
The Vexa skill bundle is a legitimate integration for managing meeting bots on platforms like Zoom, Google Meet, and Microsoft Teams. The code provides functional CLI tools (vexa.mjs, ingest.mjs, onboard.mjs) for starting bots, retrieving transcripts, and generating meeting reports. Security best practices are implemented, including the use of 'chmod 600' for local secret files, mandatory confirmation flags for destructive 'DELETE' operations, and explicit instructions in SKILL.md and onboarding-flow.md directing the AI agent never to ask users for API keys in chat. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.
能力评估
Purpose & Capability
The name/description and the included scripts match: the code implements starting/stopping bots, fetching transcripts, creating reports, and webhook transforms for Vexa. However the registry metadata claimed no required env vars while SKILL.md and the scripts clearly require VEXA_API_KEY (and support per-endpoint API keys). That metadata mismatch is unexplained and should be corrected/clarified.
Instruction Scope
Runtime instructions and bundled scripts instruct the agent to run the included Node CLI scripts which: read and persist VEXA_API_KEY in skills/vexa/secrets, write reports into memory/meetings/, and read local OpenClaw files (e.g., openclaw.json, sessions.json) and cloudflared credentials to check webhook and session state. Reading other local config/session files and ~/.cloudflared is outside a minimal 'meeting bot' scope and increases sensitivity — the scripts do not transmit those local files externally in the repo, but they do access potentially sensitive tokens/config values locally.
Install Mechanism
No external install steps or downloads are requested; the skill is instruction + bundled scripts that run locally with node. There is no remote archive download or third-party package installation specified in the manifest.
Credentials
The skill actually requires VEXA_API_KEY (and optionally VEXA_BASE_URL), but the registry 'Required env vars' field lists none — this is an incoherence. The scripts also attempt to read OpenClaw-related files (openclaw.json, sessions.json) and cloudflared credentials in the user's home directory; those accesses are somewhat justifiable for webhook validation but are broader than just needing a single API key.
Persistence & Privilege
The skill does persist the API key into skills/vexa/secrets/vexa.env (and supports persisting state under secrets/). It does not request always:true. The scripts may execute child processes (spawnSync) to run onboarding/ingest flows — expected for a CLI. Autonomous invocation (disable-model-invocation: false) is the platform default; combined with the script's ability to read local OpenClaw config and sessions, this increases blast radius if the skill were compromised, so exercise caution.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install vexa - 安装完成后，直接呼叫该 Skill 的名称或使用
/vexa触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.3
v0.1.3 adds improved self-hosting support and updates onboarding security.
- Updated to clarify support for both Vexa Cloud and self-hosted instances.
- Onboarding now instructs users to set up API keys themselves (never paste keys into chat).
- Improved documentation for environment variable setup and secrets management.
- Minor text and security clarifications throughout onboarding and setup references.
v0.1.2
v0.1.2: Added .clawhubignore to exclude secrets/ from published package. Fixes security flag.
v0.1.1
v0.1.1: Added Zoom support, recordings (list/get/delete/download/config), meeting bundle command, simplified description, environment switching
v0.0.1
Google Meet and MS Teams transcription delivered real time or anytime
Claw is you meeting assistant one
元数据
常见问题
Skill Vexa 是什么？
Send bots to Zoom, Google Meet, and Microsoft Teams meetings. Get live transcripts, recordings, and reports. Works with Vexa Cloud or your own self-hosted in... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1288 次。
如何安装 Skill Vexa？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install vexa」即可一键安装，无需额外配置。
Skill Vexa 是免费的吗？
是的，Skill Vexa 完全免费（开源免费），可自由下载、安装和使用。
Skill Vexa 支持哪些平台？
Skill Vexa 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Skill Vexa？
由 DmitriyG228（@dmitriyg228）开发并维护，当前版本 v0.1.3。
推荐 Skills