ClawHub
Back to skill

Security audit

Matrix Channel Fix

Security checks for vulnerabilities and agentic risk

Overview

This Matrix troubleshooting skill is mostly purpose-aligned, but it gives high-impact repair commands without enough safeguards for credentials, account state, package installation, and room-leaving actions.

Review this skill carefully before installing or following it. Prefer backups or renaming state directories instead of rm -rf, pin and verify package versions before modifying a system-wide OpenClaw install, avoid putting Matrix passwords or access tokens directly in shell commands, and confirm the exact rooms/accounts affected before running leave or reset operations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Dependency Installation in a System-Wide OpenClaw Directory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
cd /usr/local/lib/node_modules/openclaw
pnpm add @matrix-org/matrix-sdk-crypto-nodejs
pnpm rebuild @matrix-org/matrix-sdk-crypto-nodejs

Technical Analysis

The repair procedure installs a third-party package without specifying an exact version, verifying an integrity hash, requiring a reviewed lockfile, or validating the registry source. The package is installed directly into a system-wide OpenClaw installation.

Package installation and rebuild operations may execute package lifecycle or native build scripts. Consequently, the effective code executed by this procedure can change after the skill has been reviewed. A compromised registry account, malicious package release, registry substitution, or unexpectedly incompatible update could introduce arbitrary code into the OpenClaw environment.

Attack Path

  1. An attacker compromises the package, its publisher account, or the package registry resolution path.
  2. The attacker publishes a malicious version or causes the package name to resolve to an unsafe source.
  3. An administrator follows the documented repair procedure.
  4. pnpm add selects the mutable registry version because no exact version is specified.
  5. Installation or rebuild scripts execute with the privileges of the administrator running the command.
  6. The malicious component gains access to the OpenClaw installation and data available to that account.

Impact Assessment

Exploitation could modify the system-wide OpenClaw installation, execute package lifecycle code, read configuration and credentials accessible to the invoking account, or compromise the gateway process. The exact privilege level depends on the account used to run the package manager; running the instructions with elevated privileges would significantly in ...[truncated 18 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed exact version rather than relying on the latest registry-selected release.
  • Use a committed and reviewed lockfile containing integrity metadata.
  • Explicitly configure and verify the trusted package registry.
  • Verify package signatures, provenance, and published checksums where available.
  • Disable package lifecycle scripts during installation unless they are strictly required and audited.
  • Test dependency updates in an isolated staging environment before modifying a system-wide installation.
  • Run package-management operations with the least privileges necessary.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:39
Finding

Destructive Wildcard Deletion of All Matrix Account State

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-40
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

bash
rm -rf ~/.openclaw/matrix/accounts/*
openclaw gateway restart

Technical Analysis

The token-recovery procedure recursively deletes every entry under the Matrix accounts directory. It does not identify the account associated with the expired token, confirm the resolved target path, create a backup, or request confirmation before deletion.

Although the stated objective is to clear an invalid token, the wildcard operation can remove unrelated account sessions and potentially encryption or device state. The subsequent gateway restart occurs after the data has already been deleted and does not provide a recovery mechanism.

Attack Path

  1. A user encounters an expired token for one Matrix account.
  2. The user follows the documented recovery procedure.
  3. The wildcard expands to every entry in ~/.openclaw/matrix/accounts/.
  4. rm -rf recursively and irreversibly removes all matching account state.
  5. The gateway restarts without the deleted sessions or associated local state.
  6. Unrelated Matrix accounts may be logged out or lose locally stored state.

Impact Assessment

The command can cause denial of service for every configured Matrix account belonging to the current user. It may force reauthentication, remove session information, and potentially make locally stored encrypted conversation state unavailable. Its scope is normally limited to the invoking user's OpenClaw data, but the consequences may affect every Matrix channel configured under that account.

Remediation
View remediation

Remediation Suggestions

  • Identify the affected Matrix account and remove only its invalid token.
  • Avoid recursive wildcard deletion for credential recovery.
  • Resolve and validate the target path before performing any deletion.
  • Display the files that will be affected and require explicit user confirmation.
  • Back up account and encryption state before making destructive changes.
  • Prefer a supported OpenClaw logout or token-reset command where available.
  • Document restoration and reauthentication procedures before suggesting state deletion.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:69
Finding

Matrix Password Exposure Through Command-Line Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 69
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code

bash
openclaw config set channels.matrix.homeserver "https://YOUR_HOMESERVER:PORT"
openclaw config set channels.matrix.userId "@YOUR_BOT_USER_ID"
openclaw config set channels.matrix.password "YOUR_PASSWORD"
openclaw config set channels.matrix.deviceName "YOUR_DEVICE_NAME"
openclaw config set channels.matrix.encryption true
openclaw config set channels.matrix.enabled true

Technical Analysis

The instructions direct the user to substitute a real Matrix password directly into a shell command. Command-line secrets can be retained in shell history, terminal session recordings, troubleshooting transcripts, audit logs, and command telemetry. Depending on operating-system process visibility and command duration, arguments may also be visible through process-inspection interfaces.

The procedure provides no protected prompt, standard-input mechanism, secret manager integration, history suppression, or guidance for verifying restrictive permissions on the resulting configuration.

Attack Path

  1. The user replaces YOUR_PASSWORD with the real Matrix password.
  2. The shell records the complete command in history or a terminal-recording facility captures it.
  3. A local user, administrator, support bundle, backup system, or log collector obtains the recorded command.
  4. The exposed password is used to authenticate to the Matrix homeserver as the bot account.

Impact Assessment

An attacker obtaining the password may impersonate the Matrix bot and exercise all permissions assigned to that account. Depending on Matrix room membership and authorization, this may include reading accessible messages, sending messages, joining or leaving rooms, and changing account or device state. Exposure is primarily available to principals or systems that can i ...[truncated 48 chars]

Remediation
View remediation

Remediation Suggestions

  • Read the password through an interactive hidden prompt rather than a command-line argument.
  • Support protected standard input, a credential helper, environment-specific secret store, or operating-system secret manager.
  • Store only a reference to the secret where the application supports that model.
  • Ensure any configuration containing credentials is readable only by the service account.
  • Avoid placing secrets in shell history, scripts, examples, logs, or troubleshooting output.
  • Rotate the Matrix password if it has already been entered using the documented command.
  • Prefer short-lived access tokens with restricted scope where supported.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:86
Finding

Matrix Credentials and Bearer Token Exposed in Shell and Process Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 86-99
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

bash
TOKEN=$(curl -s -X POST "https://YOUR_HOMESERVER:PORT/_matrix/client/r0/login" \
  -H "Content-Type: application/json" \
  -d '{"type":"m.login.password","user":"YOUR_BOT_USER","password":"YOUR_PASSWORD"}' | \
  jq -r '.access_token')

curl -s -X GET "https://YOUR_HOMESERVER:PORT/_matrix/client/r0/joined_rooms" \
  -H "Authorization: Bearer $TOKEN" | jq '.'

for room in "ROOM_ID_1" "ROOM_ID_2"; do
  curl -s -X POST "https://YOUR_HOMESERVER:PORT/_matrix/client/r0/rooms/$room/leave" \
    -H "Authorization: Bearer $TOKEN"
done

Technical Analysis

The login request embeds the Matrix username and password directly in the shell command. The password may therefore persist in shell history, terminal recordings, scripts, or collected diagnostics.

The resulting access token is stored in the shell variable TOKEN and expanded into each curl authorization-header argument. During execution, the expanded bearer token may be observable through process inspection or command tracing. The procedure also does not clear the token after use, validate that jq returned a real token, restrict the token's scope, or protect against diagnostic tooling that records command arguments.

Because a bearer token grants access to any party possessing it, disclosure does not require knowledge of the original password.

Attack Path

  1. The user inserts real credentials into the login command.
  2. The command is stored in shell history or captured by terminal or audit tooling.
  3. The homeserver returns an access token, which is assigned to TOKEN.
  4. The shell expands $TOKEN into the curl authorization argument.
  5. A local observer, process monitor, shell tracer, or diagnostic collector captures the password or bearer token.
  6. The attacker se ...[truncated 638 chars]
Remediation
View remediation

Remediation Suggestions

  • Acquire the password through a hidden interactive prompt or trusted secret manager.
  • Avoid embedding passwords in JSON command-line arguments.
  • Avoid expanding bearer tokens into command arguments visible to process-inspection tools.
  • Use a permission-restricted temporary curl configuration or another client mechanism that does not expose secrets in the process argument list.
  • Create temporary credential files with mode 0600, delete them securely after use, and ensure they are never committed or logged.
  • Validate that the login response succeeded before using the extracted value.
  • Use short-lived, narrowly scoped tokens where supported.
  • Clear the shell variable immediately after use with unset TOKEN.
  • Revoke exposed tokens and rotate any password previously used with this procedure.
  • Disable command tracing and prevent secret-bearing commands from entering shell history.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

症状：

text
errcode: 'M_UNKNOWN_TOKEN', error: 'Invalid access token passed.'

修复：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The explicit command rm -rf ~/.openclaw/matrix/accounts/* is a real destructive operation against persistent account data. In a support skill, providing a one-line recursive delete without guardrails, validation, or backup instructions materially increases the risk of accidental or unnecessary deletion.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

修复： 清除旧 token 并重启：

bash
rm -rf ~/.openclaw/matrix/accounts/*
openclaw gateway restart

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The explicit command rm -rf ~/.openclaw/matrix/accounts/* is a real destructive operation against persistent account data. In a support skill, providing a one-line recursive delete without guardrails, validation, or backup instructions materially increases the risk of accidental or unnecessary deletion.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

修复： 清除旧 token 并重启：

bash
rm -rf ~/.openclaw/matrix/accounts/*
openclaw gateway restart

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to delete all Matrix account state under ~/.openclaw/matrix/accounts/* using rm -rf, but it does not warn that this removes persisted auth/session data and can force re-authentication or disrupt service. In an operational troubleshooting skill, destructive state deletion without explicit backup, confirmation, or impact notice creates avoidable risk of outage and data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The full reset procedure removes Matrix configuration and replaces credentials, but it omits warnings about service interruption, credential exposure in shell history, and the need to securely re-enter secrets. Because this is a recovery guide for a production channel, the lack of safeguards increases the chance of accidental downtime or mishandling of sensitive configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The room-exit workflow logs in with a password, captures an access token, and performs leave operations without warning that credentials and bearer tokens are being handled in shell commands. It also does not warn that leaving rooms is operationally impactful and may disconnect the bot from active communications or automations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

bash
# 获取 access_token
TOKEN=$(curl -s -X POST "https://YOUR_HOMESERVER:PORT/_matrix/client/r0/login" \
  -H "Content-Type: application/json" \
  -d '{"type":"m.login.password","user":"YOUR_BOT_USER","password":"YOUR_PASSWORD"}' | \
  jq -r '.access_token')

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:39