Security audit
Mattermost
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Mattermost channel plugin that uses a bot token to connect OpenClaw to Mattermost with disclosed messaging, command, and access-control features.
Install only if you intend to let OpenClaw read authorized Mattermost conversations and post as the configured bot. Review bot permissions, keep DM and group allowlists tight, enable native slash commands or message reads only when needed, and use private-network access only for a trusted Mattermost server.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.