Security audit

Matrix

Security checks for vulnerabilities and agentic risk

Overview

This package is a coherent Matrix channel plugin that uses Matrix credentials and local state for its stated messaging purpose.

Install this only for Matrix accounts you intend OpenClaw agents to use. Review room and DM allowlists, autoJoin, execApprovals approvers, E2EE/private-network options, and Matrix account permissions before enabling it in sensitive rooms.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.obfuscated_code

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/crypto-api/index.d.ts:1083
Evidence: privateKey: [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/crypto-api/index.js.map:1
Evidence: {"version":3,"file":"index.js","names":[],"sources":["../../src/crypto-api/index.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\n...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/embedded.js.map:1
Evidence: {"version":3,"file":"embedded.js","names":["roomId"],"sources":["../src/embedded.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\n...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/http-api/fetch.js.map:1
Evidence: {"version":3,"file":"fetch.js","names":[],"sources":["../../src/http-api/fetch.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLi...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/interactive-auth.d.ts:44
Evidence: Password = "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/oauth/tokenRefresher.js.map:1
Evidence: {"version":3,"file":"tokenRefresher.js","names":[],"sources":["../../src/oauth/tokenRefresher.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundati...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/src/crypto-api/index.ts:1265
Evidence: privateKey: [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/src/interactive-auth.ts:75
Evidence: Password = "[REDACTED]",

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: node_modules/matrix-js-sdk/node_modules/another-json/spec/another-json-spec.js:43
Evidence: var object = {a: '\x00\x01\x02\x03\x04\x05\x06\x07'};

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: node_modules/matrix-js-sdk/node_modules/sdp-transform/lib/grammar.js:272
Evidence: reg: /^ssrc-group:([\x21\x23\x24\x25\x26\x27\x2A\x2B\x2D\x2E\w]*) (.*)/,