Zoom Meeting Assistance Rtms Unofficial Community

Zoom RTMS Meeting Assistant — start on-demand to capture meeting audio, video, transcript, screenshare, and chat via Zoom Real-Time Media Streams. Handles meeting.rtms_started and meeting.rtms_stopped webhook events. Provides AI-powered dialog suggestions, sentiment analysis, and live summaries with WhatsApp notifications. Use when a Zoom RTMS webhook fires or the user asks to record/analyze a meeting.

This skill appears to do what it claims (record RTMS streams, run local AI analysis, and notify via OpenClaw), but the packaging has gaps and the data flows have privacy implications. Before installing: 1) Treat it as untrusted third‑party code — review index.js and chatWithClawdbot.js (they call openclaw and ffmpeg). 2) Verify required environment variables (ZOOM_SECRET_TOKEN, ZOOM_CLIENT_ID, ZOOM_CLIENT_SECRET, OPENCLAW_NOTIFY_TARGET, OPENCLAW_BIN) and ensure the registry entry is updated — the published metadata currently omits them. 3) Confirm where notifications will be sent (OPENCLAW_NOTIFY_TARGET) and disable notifications during testing. 4) Run in a sandbox or isolated VM; do not expose the webhook port publicly until you verify request validation and consent policies. 5) Check for the auxiliary files the code reads (e.g., sps_pps_keyframe.h264, black_frame.h264) and ensure they come from a trusted source. 6) If you plan to record meetings, ensure you have participant consent and that storing transcripts/media locally complies with policy/regulation. If you are not comfortable auditing the code or managing the OpenClaw binary and webhook exposure, do not deploy this skill in production.

Type: OpenClaw Skill Name: zoom-meeting-assistance-with-rtms-unofficial-community-skill Version: 0.1.3 The skill is classified as suspicious due to its use of `child_process.execFile` and `child_process.exec` in `chatWithClawdbot.js`, `convertMeetingMedia.js`, and `muxMixedAudioAndActiveSpeakerVideo.js` to execute external binaries (`openclaw` and `ffmpeg`). While these are used for the stated purpose of AI processing and media conversion, they represent broad capabilities that could be exploited if the `OPENCLAW_BIN` environment variable is compromised or if the `openclaw` CLI itself has vulnerabilities. Additionally, the skill employs extensive prompt engineering in files like `summary_prompt.md` and `query_prompt.md` to strictly control the AI agent's output format and behavior, which, while intended for functionality, highlights a significant prompt injection attack surface against the AI agent.