Matrix Channel Fix

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:55 PM UTC
• Version: 1.0.0

Overview

This Matrix troubleshooting skill is mostly purpose-aligned, but it gives high-impact repair commands without enough safeguards for credentials, account state, package installation, and room-leaving actions.

Review this skill carefully before installing or following it. Prefer backups or renaming state directories instead of rm -rf, pin and verify package versions before modifying a system-wide OpenClaw install, avoid putting Matrix passwords or access tokens directly in shell commands, and confirm the exact rooms/accounts affected before running leave or reset operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23
• Finding: Unpinned Dependency Installation in a System-Wide OpenClaw Directory## Vulnerability Details **File Location**: `SKILL.md`, lines 23-25 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash cd /usr/local/lib/node_modules/openclaw pnpm add @matrix-org/matrix-sdk-crypto-nodejs pnpm rebuild @matrix-org/matrix-sdk-crypto-nodejs ``` ### Technical Analysis The repair procedure installs a third-party package without specifying an exact version, verifying an integrity hash, requiring a reviewed lockfile, or validating the registry source. The package is installed directly into a system-wide OpenClaw installation. Package installation and rebuild operations may execute package lifecycle or native build scripts. Consequently, the effective code executed by this procedure can change after the skill has been reviewed. A compromised registry account, malicious package release, registry substitution, or unexpectedly incompatible update could introduce arbitrary code into the OpenClaw environment. ### Attack Path 1. An attacker compromises the package, its publisher account, or the package registry resolution path. 2. The attacker publishes a malicious version or causes the package name to resolve to an unsafe source. 3. An administrator follows the documented repair procedure. 4. `pnpm add` selects the mutable registry version because no exact version is specified. 5. Installation or rebuild scripts execute with the privileges of the administrator running the command. 6. The malicious component gains access to the OpenClaw installation and data available to that account. ### Impact Assessment Exploitation could modify the system-wide OpenClaw installation, execute package lifecycle code, read configuration and credentials accessible to the invoking account, or compromise the gateway process. The exact privilege level depends on the account used to run the package manager; running the instructions with elevated privileges would significantly in ...[truncated 18 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to a reviewed exact version rather than relying on the latest registry-selected release. - Use a committed and reviewed lockfile containing integrity metadata. - Explicitly configure and verify the trusted package registry. - Verify package signatures, provenance, and published checksums where available. - Disable package lifecycle scripts during installation unless they are strictly required and audited. - Test dependency updates in an isolated staging environment before modifying a system-wide installation. - Run package-management operations with the least privileges necessary.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39
• Finding: Destructive Wildcard Deletion of All Matrix Account State## Vulnerability Details **File Location**: `SKILL.md`, lines 39-40 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```bash rm -rf ~/.openclaw/matrix/accounts/* openclaw gateway restart ``` ### Technical Analysis The token-recovery procedure recursively deletes every entry under the Matrix accounts directory. It does not identify the account associated with the expired token, confirm the resolved target path, create a backup, or request confirmation before deletion. Although the stated objective is to clear an invalid token, the wildcard operation can remove unrelated account sessions and potentially encryption or device state. The subsequent gateway restart occurs after the data has already been deleted and does not provide a recovery mechanism. ### Attack Path 1. A user encounters an expired token for one Matrix account. 2. The user follows the documented recovery procedure. 3. The wildcard expands to every entry in `~/.openclaw/matrix/accounts/`. 4. `rm -rf` recursively and irreversibly removes all matching account state. 5. The gateway restarts without the deleted sessions or associated local state. 6. Unrelated Matrix accounts may be logged out or lose locally stored state. ### Impact Assessment The command can cause denial of service for every configured Matrix account belonging to the current user. It may force reauthentication, remove session information, and potentially make locally stored encrypted conversation state unavailable. Its scope is normally limited to the invoking user's OpenClaw data, but the consequences may affect every Matrix channel configured under that account.
• Remediation: ## Remediation Suggestions - Identify the affected Matrix account and remove only its invalid token. - Avoid recursive wildcard deletion for credential recovery. - Resolve and validate the target path before performing any deletion. - Display the files that will be affected and require explicit user confirmation. - Back up account and encryption state before making destructive changes. - Prefer a supported OpenClaw logout or token-reset command where available. - Document restoration and reauthentication procedures before suggesting state deletion.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:69
• Finding: Matrix Password Exposure Through Command-Line Configuration## Vulnerability Details **File Location**: `SKILL.md`, line 69 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```bash openclaw config set channels.matrix.homeserver "https://YOUR_HOMESERVER:PORT" openclaw config set channels.matrix.userId "@YOUR_BOT_USER_ID" openclaw config set channels.matrix.password "YOUR_PASSWORD" openclaw config set channels.matrix.deviceName "YOUR_DEVICE_NAME" openclaw config set channels.matrix.encryption true openclaw config set channels.matrix.enabled true ``` ### Technical Analysis The instructions direct the user to substitute a real Matrix password directly into a shell command. Command-line secrets can be retained in shell history, terminal session recordings, troubleshooting transcripts, audit logs, and command telemetry. Depending on operating-system process visibility and command duration, arguments may also be visible through process-inspection interfaces. The procedure provides no protected prompt, standard-input mechanism, secret manager integration, history suppression, or guidance for verifying restrictive permissions on the resulting configuration. ### Attack Path 1. The user replaces `YOUR_PASSWORD` with the real Matrix password. 2. The shell records the complete command in history or a terminal-recording facility captures it. 3. A local user, administrator, support bundle, backup system, or log collector obtains the recorded command. 4. The exposed password is used to authenticate to the Matrix homeserver as the bot account. ### Impact Assessment An attacker obtaining the password may impersonate the Matrix bot and exercise all permissions assigned to that account. Depending on Matrix room membership and authorization, this may include reading accessible messages, sending messages, joining or leaving rooms, and changing account or device state. Exposure is primarily available to principals or systems that can i ...[truncated 48 chars]
• Remediation: ## Remediation Suggestions - Read the password through an interactive hidden prompt rather than a command-line argument. - Support protected standard input, a credential helper, environment-specific secret store, or operating-system secret manager. - Store only a reference to the secret where the application supports that model. - Ensure any configuration containing credentials is readable only by the service account. - Avoid placing secrets in shell history, scripts, examples, logs, or troubleshooting output. - Rotate the Matrix password if it has already been entered using the documented command. - Prefer short-lived access tokens with restricted scope where supported.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:86
• Finding: Matrix Credentials and Bearer Token Exposed in Shell and Process Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 86-99 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```bash TOKEN=$(curl -s -X POST "https://YOUR_HOMESERVER:PORT/_matrix/client/r0/login" \ -H "Content-Type: application/json" \ -d '{"type":"m.login.password","user":"YOUR_BOT_USER","password":"YOUR_PASSWORD"}' | \ jq -r '.access_token') curl -s -X GET "https://YOUR_HOMESERVER:PORT/_matrix/client/r0/joined_rooms" \ -H "Authorization: Bearer $TOKEN" | jq '.' for room in "ROOM_ID_1" "ROOM_ID_2"; do curl -s -X POST "https://YOUR_HOMESERVER:PORT/_matrix/client/r0/rooms/$room/leave" \ -H "Authorization: Bearer $TOKEN" done ``` ### Technical Analysis The login request embeds the Matrix username and password directly in the shell command. The password may therefore persist in shell history, terminal recordings, scripts, or collected diagnostics. The resulting access token is stored in the shell variable `TOKEN` and expanded into each `curl` authorization-header argument. During execution, the expanded bearer token may be observable through process inspection or command tracing. The procedure also does not clear the token after use, validate that `jq` returned a real token, restrict the token's scope, or protect against diagnostic tooling that records command arguments. Because a bearer token grants access to any party possessing it, disclosure does not require knowledge of the original password. ### Attack Path 1. The user inserts real credentials into the login command. 2. The command is stored in shell history or captured by terminal or audit tooling. 3. The homeserver returns an access token, which is assigned to `TOKEN`. 4. The shell expands `$TOKEN` into the `curl` authorization argument. 5. A local observer, process monitor, shell tracer, or diagnostic collector captures the password or bearer token. 6. The attacker se ...[truncated 638 chars]
• Remediation: ## Remediation Suggestions - Acquire the password through a hidden interactive prompt or trusted secret manager. - Avoid embedding passwords in JSON command-line arguments. - Avoid expanding bearer tokens into command arguments visible to process-inspection tools. - Use a permission-restricted temporary curl configuration or another client mechanism that does not expose secrets in the process argument list. - Create temporary credential files with mode `0600`, delete them securely after use, and ensure they are never committed or logged. - Validate that the login response succeeded before using the extracted value. - Use short-lived, narrowly scoped tokens where supported. - Clear the shell variable immediately after use with `unset TOKEN`. - Revoke exposed tokens and rotate any password previously used with this procedure. - Disable command tracing and prevent secret-bearing commands from entering shell history.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

**症状：**
```
errcode: 'M_UNKNOWN_TOKEN', error: 'Invalid access token passed.'
```

**修复：**

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**修复：**
清除旧 token 并重启：
```bash
rm -rf ~/.openclaw/matrix/accounts/*
openclaw gateway restart
```

• Confidence: 97% confidence
• Finding: The explicit command rm -rf ~/.openclaw/matrix/accounts/* is a real destructive operation against persistent account data. In a support skill, providing a one-line recursive delete without guardrails, validation, or backup instructions materially increases the risk of accidental or unnecessary deletion.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**修复：**
清除旧 token 并重启：
```bash
rm -rf ~/.openclaw/matrix/accounts/*
openclaw gateway restart
```

• Confidence: 97% confidence
• Finding: The explicit command rm -rf ~/.openclaw/matrix/accounts/* is a real destructive operation against persistent account data. In a support skill, providing a one-line recursive delete without guardrails, validation, or backup instructions materially increases the risk of accidental or unnecessary deletion.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to delete all Matrix account state under ~/.openclaw/matrix/accounts/* using rm -rf, but it does not warn that this removes persisted auth/session data and can force re-authentication or disrupt service. In an operational troubleshooting skill, destructive state deletion without explicit backup, confirmation, or impact notice creates avoidable risk of outage and data loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The full reset procedure removes Matrix configuration and replaces credentials, but it omits warnings about service interruption, credential exposure in shell history, and the need to securely re-enter secrets. Because this is a recovery guide for a production channel, the lack of safeguards increases the chance of accidental downtime or mishandling of sensitive configuration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The room-exit workflow logs in with a password, captures an access token, and performs leave operations without warning that credentials and bearer tokens are being handled in shell commands. It also does not warn that leaving rooms is operationally impactful and may disconnect the bot from active communications or automations.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 获取 access_token
TOKEN=$(curl -s -X POST "https://YOUR_HOMESERVER:PORT/_matrix/client/r0/login" \
  -H "Content-Type: application/json" \
  -d '{"type":"m.login.password","user":"YOUR_BOT_USER","password":"YOUR_PASSWORD"}' | \
  jq -r '.access_token')

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:39