Security audit
Mattermost
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Mattermost channel plugin that uses expected bot-token, network, posting, reading, and callback capabilities for that purpose.
Install only if you want OpenClaw to operate a Mattermost bot. Use a least-privilege bot token, verify the package publisher/source, keep message reads, native slash commands, open DM/group policies, raw command progress, and private-network access disabled unless you need them, and configure allowlists for who may invoke the bot.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.