Zoom Manager

Manage Zoom meetings via OAuth API. Create, list, delete, and update events.

This skill likely does what it claims (talks to Zoom's REST API) but has packaging and documentation mismatches that could expose credentials or cause runtime errors. Before installing or running it: 1) Ask the publisher which script is canonical (zoom-cli.js vs the per-action scripts) and whether credentials should be provided via environment variables or a config.json. 2) Prefer keeping secrets in environment variables (not stored in config.json on disk); if a config file is required, store it securely and restrict file permissions. 3) Review and fix the JS bugs (e.g., delete_meeting.js tries to use a fetch 'auth' option instead of an Authorization header). 4) Run the code in an isolated environment with least-privilege Zoom credentials (create a dedicated Server-to-Server OAuth app with only required scopes and use a non-production account). 5) Because the skill owner/source is unknown, treat credentials cautiously — do not reuse high-privilege production credentials until you confirm the packaging and credential storage behavior.

Type: OpenClaw Skill Name: zoom-manager-clawd Version: 0.1.0 The skill is designed to manage Zoom meetings (create, list, update, delete) and interacts with the legitimate Zoom API. The `SKILL.md` correctly instructs the user to set Zoom API credentials as environment variables, and the primary entry point `scripts/zoom-cli.js` properly retrieves these secrets from `process.env`. While several other individual scripts (`scripts/create_meeting.js/py`, `scripts/delete_meeting.js/py`, etc.) attempt to load credentials from a non-existent `config.json` file, these scripts are not referenced in the `SKILL.md`'s command section, and the `config.json` file itself is not part of the skill bundle. This inconsistency is a minor code quality issue but does not indicate malicious intent or a direct vulnerability. The requested Zoom API scopes are broad but align with the skill's stated purpose.