Security audit

Matrix

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Matrix channel plugin that uses Matrix credentials and state to let OpenClaw receive and send Matrix messages as advertised.

Install only with a dedicated Matrix bot account or another account you are comfortable letting OpenClaw operate. Review room/DM allowlists, groupPolicy, autoJoin, actions, execApprovals, and encryption settings before enabling it, because the plugin can read Matrix conversations and perform configured Matrix actions using the supplied credentials.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.obfuscated_code

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/crypto-api/index.d.ts:1083
Evidence: privateKey: [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/crypto-api/index.js.map:1
Evidence: {"version":3,"file":"index.js","names":[],"sources":["../../src/crypto-api/index.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundation C.I.C.\n\n...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/embedded.js.map:1
Evidence: {"version":3,"file":"embedded.js","names":["roomId"],"sources":["../src/embedded.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\n...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/http-api/fetch.js.map:1
Evidence: {"version":3,"file":"fetch.js","names":[],"sources":["../../src/http-api/fetch.ts"],"sourcesContent":["/*\nCopyright 2022 The Matrix.org Foundation C.I.C.\n\nLi...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/interactive-auth.d.ts:44
Evidence: Password = "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/lib/oauth/tokenRefresher.js.map:1
Evidence: {"version":3,"file":"tokenRefresher.js","names":[],"sources":["../../src/oauth/tokenRefresher.ts"],"sourcesContent":["/*\nCopyright 2023 The Matrix.org Foundati...

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/src/crypto-api/index.ts:1265
Evidence: privateKey: [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: node_modules/matrix-js-sdk/src/interactive-auth.ts:75
Evidence: Password = "[REDACTED]",

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: node_modules/matrix-js-sdk/node_modules/another-json/spec/another-json-spec.js:43
Evidence: var object = {a: '\x00\x01\x02\x03\x04\x05\x06\x07'};

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: node_modules/matrix-js-sdk/node_modules/sdp-transform/lib/grammar.js:272
Evidence: reg: /^ssrc-group:([\x21\x23\x24\x25\x26\x27\x2A\x2B\x2D\x2E\w]*) (.*)/,