Security audit

Matrix

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Matrix channel plugin that needs Matrix credentials and can read/reply in configured Matrix rooms, with sensitive behavior disclosed and controlled by configuration.

Install only for Matrix accounts you are comfortable letting OpenClaw agents use. Review room/DM allowlists, autoJoin, actions, execApprovals, and private-network settings before enabling; avoid broad wildcards unless you want broad Matrix users or rooms to trigger or approve agent activity.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.obfuscated_code

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/crypto-api/index.d.ts:1083
Evidence: privateKey: [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/crypto-api/index.js.map:1
Evidence: {"version":3,"file":"index.js","names":[],"sources":["../../src/crypto-api/index.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\n...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/embedded.js.map:1
Evidence: {"version":3,"file":"embedded.js","names":["roomId"],"sources":["../src/embedded.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\n...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/http-api/fetch.js.map:1
Evidence: {"version":3,"file":"fetch.js","names":[],"sources":["../../src/http-api/fetch.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLi...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/interactive-auth.d.ts:44
Evidence: Password = "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/oauth/tokenRefresher.js.map:1
Evidence: {"version":3,"file":"tokenRefresher.js","names":[],"sources":["../../src/oauth/tokenRefresher.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundati...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/src/crypto-api/index.ts:1265
Evidence: privateKey: [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/src/interactive-auth.ts:75
Evidence: Password = "[REDACTED]",

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: node_modules/matrix-js-sdk/node_modules/another-json/spec/another-json-spec.js:43
Evidence: var object = {a: '\x00\x01\x02\x03\x04\x05\x06\x07'};

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: node_modules/matrix-js-sdk/node_modules/sdp-transform/lib/grammar.js:272
Evidence: reg: /^ssrc-group:([\x21\x23\x24\x25\x26\x27\x2A\x2B\x2D\x2E\w]*) (.*)/,