Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Matrix administration helper, but it gives an agent broad room, user, message, and file-sharing authority without enough safeguards around sensitive files and recipients.
Install only in a trusted manager environment where the agent is allowed to administer the Matrix homeserver. Before using it, require explicit user approval for user registration, room creation, membership changes, and any file upload; redact logs and config exports, verify the target room and members, and never expose registration tokens, passwords, or Matrix access tokens in chat or uploaded files.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Response includes user_id and access_token.
curl -X POST http://127.0.0.1:6167/_matrix/client/v3/login \
The skill description creates a policy contradiction: it says Matrix management should only be used for explicit standalone admin requests, yet the body includes instructions for worker room creation and worker messaging workflows. That ambiguity can cause an agent to perform Matrix-side actions without a clear user authorization boundary, increasing the chance of unintended account, room, or message operations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST http://127.0.0.1:6167/_matrix/client/v3/register \
-H 'Content-Type: application/json' \
-d '{
"username": "<USERNAME>",
The skill instructs the agent to upload arbitrary files and notes that uploaded media is accessible to all room members, but it does not require a sensitivity check, recipient validation, or user warning first. This can lead to accidental disclosure of confidential artifacts such as reports, logs, or configuration data to unintended parties in a room.
The skill explicitly encourages sending artifacts like config exports and log files over Matrix to an admin. Those artifact types often contain secrets, internal topology, personal data, or session material, so broad instructions to share them without sanitization or approval gates materially increase the risk of sensitive data disclosure.
The skill states that admin-related environment variables and passwords are preconfigured in the container, and later uses registration tokens and bearer tokens for server management actions. While this is necessary for the skill, the markdown does not include a warning that these credentials are sensitive and must not be exposed, echoed, or shared in outputs.