Security audit
Rocket.Chat
Security checks for vulnerabilities and agentic risk
Overview
This Rocket.Chat connector largely matches its purpose, but needs Review because it stores and reuses powerful chat admin credentials for runtime chat-driven admin actions despite documentation suggesting the admin token is only for setup.
Install only if you are comfortable letting this plugin connect to your Rocket.Chat server, store bot credentials, and potentially retain an admin token. Consider deleting the saved admin credential after setup if ongoing chat-based bot administration is not needed, restrict the configured owner and access grants carefully, review any repeating cron jobs, and prune ~/.openclaw/media/inbound periodically.
SkillSpector was not run because this plugin release contains no bundled skills.
Endor dependency reachability
Checked Nov 8, 2026 · 5:27 AM UTC
No reachable vulnerabilities reported
Endor dependency scan completed.