Security audit
Rocket.Chat
Security checks for vulnerabilities and agentic risk
Overview
This Rocket.Chat plugin is mostly coherent, but it exposes broad chat-administration and local-file upload powers that need careful review before installation.
Install only with a least-privilege Rocket.Chat bot account, restrict which users and rooms can reach the bot, avoid granting admin roles unless the agent truly needs them, and treat file upload actions as sensitive because they can send local files to Rocket.Chat.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.