RocketChat

Rocket.Chat team messaging - channels, messages, users, integrations via REST API

Security Scan

The skill is an instruction-only Rocket.Chat REST API helper whose required binaries and environment variables match its described purpose.

Purpose & Capability

Name/description claim Rocket.Chat REST API access; required env vars (RC_URL, RC_TOKEN, RC_USER_ID) and required binaries (curl, optional jq) are exactly what an API-based chat integration needs.

Instruction Scope

SKILL.md contains concrete curl examples that only reference the Rocket.Chat API, the declared env vars, and optional jq. It does not instruct reading unrelated system files, other credentials, or exfiltrating data to unexpected endpoints.

Install Mechanism

No install spec and no code files — instruction-only. Nothing is downloaded or written to disk by an installer.

Credentials

Requested environment variables are limited to the Rocket.Chat URL and authentication (RC_URL, RC_TOKEN, RC_USER_ID). This is proportionate to the documented capabilities (posting, reading, managing messages/users).

Persistence & Privilege

always is false and the skill makes no requests to modify agent/system configuration. Autonomous invocation is allowed (platform default) but not combined with elevated persistence or other concerning privileges.

Assessment

This skill is coherent with its description: it will use the RC_URL, RC_TOKEN and RC_USER_ID you provide to call Rocket.Chat REST endpoints (read/post/edit messages, manage channels/users depending on token privileges). Because the skill is instruction-only (no installer), it won't drop code on disk, but any agent using this skill will be able to act with the permissions of the supplied token. Before installing, consider using a dedicated bot/service account with minimal required permissions (avoid full admin tokens unless necessary), restrict the token's scope and rotate it regularly, and ensure RC_URL points to a trusted Rocket.Chat instance. Also review the agent's actions when it runs (or disable autonomous invocation if you want manual control). The regex scanner found no code to analyze, which is expected for an instruction-only skill.

Rocket.Chat Skill

Open-source team chat platform for communication and collaboration.

Overview

Rocket.Chat supports:

• Channels (public/private), DMs, threads
• User and role management
• Integrations (webhooks, bots)
• Federation and omnichannel

Three room types: channels (channels.*), groups/private (groups.*), DMs (im.*). Generic chat.* endpoints work across all types via roomId.

API Authentication

# Header-based auth
curl -s \
  -H "X-Auth-Token: $RC_TOKEN" \
  -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/me"

# Get tokens from login
curl -s -X POST \
  -H "Content-Type: application/json" \
  -d '{"user":"username","password":"password"}' \
  "$RC_URL/api/v1/login" | jq '{userId: .data.userId, authToken: .data.authToken}'

Key Identifiers

• roomId — room identifier (e.g. GENERAL, ByehQjC44FwMeiLbX)
• msgId — alphanumeric message ID (not a timestamp like Slack)
• emoji — name without colons (e.g. thumbsup, white_check_mark)

Message context lines include rocketchat message id and room fields — reuse them directly.

Channels

# List channels
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/channels.list?count=50"

# Channel info
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/channels.info?roomId=ROOM_ID"

# Get channel history
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/channels.history?roomId=ROOM_ID&count=50"

# Create channel
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"name":"new-channel","members":["user1"]}' \
  "$RC_URL/api/v1/channels.create"

# Archive channel
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"roomId":"ROOM_ID"}' \
  "$RC_URL/api/v1/channels.archive"

# Set channel topic
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"roomId":"ROOM_ID","topic":"Weekly standup notes"}' \
  "$RC_URL/api/v1/channels.setTopic"

# List channel members
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/channels.members?roomId=ROOM_ID&count=50"

For private groups use groups.*, for DMs use im.*. Same query params.

Messages

# Send message (simple)
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"channel":"#general","text":"Hello!"}' \
  "$RC_URL/api/v1/chat.postMessage"

channel accepts: #channel-name, @username (DM), or a roomId.

# Send message (advanced — custom _id, alias, avatar)
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"message":{"rid":"ROOM_ID","msg":"Hello from Clawdbot"}}' \
  "$RC_URL/api/v1/chat.sendMessage"

# Read recent messages
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/channels.messages?roomId=ROOM_ID&count=20"

# Edit message
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"roomId":"ROOM_ID","msgId":"MSG_ID","text":"Updated text"}' \
  "$RC_URL/api/v1/chat.update"

# Delete message
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"roomId":"ROOM_ID","msgId":"MSG_ID"}' \
  "$RC_URL/api/v1/chat.delete"

# Search messages
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/chat.search?roomId=ROOM_ID&searchText=keyword"

# React to message (toggle — calling again removes it)
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"messageId":"MSG_ID","emoji":"thumbsup"}' \
  "$RC_URL/api/v1/chat.react"

# Get message (includes reactions in message.reactions field)
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/chat.getMessage?msgId=MSG_ID"

Pins

# Pin a message
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"messageId":"MSG_ID"}' \
  "$RC_URL/api/v1/chat.pinMessage"

# Unpin a message
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"messageId":"MSG_ID"}' \
  "$RC_URL/api/v1/chat.unPinMessage"

# List pinned messages (query is URL-encoded {"pinned":true})
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/channels.messages?roomId=ROOM_ID&query=%7B%22pinned%22%3Atrue%7D"

Users

# List users
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/users.list"

# Get user info (by username or userId)
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/users.info?username=john"

curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/users.info?userId=USER_ID"

# Create user (admin)
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"email":"[e-mail]","name":"John","username":"john","password":"pass123"}' \
  "$RC_URL/api/v1/users.create"

# Set user status
curl -s -X POST -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  -H "Content-Type: application/json" \
  -d '{"message":"In a meeting","status":"busy"}' \
  "$RC_URL/api/v1/users.setStatus"

Emoji

# List custom emoji
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/emoji-custom.list"

Integrations

# List webhooks
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/integrations.list?type=webhook-incoming"

# Use incoming webhook (no auth needed)
curl -s -X POST \
  -H "Content-Type: application/json" \
  -d '{"text":"Alert from external system!"}' \
  "$RC_URL/hooks/WEBHOOK_ID/WEBHOOK_TOKEN"

Statistics

# Server statistics
curl -s -H "X-Auth-Token: $RC_TOKEN" -H "X-User-Id: $RC_USER_ID" \
  "$RC_URL/api/v1/statistics"

Rate Limits

Default: 20 requests/second per user. Check headers: X-RateLimit-Limit, X-RateLimit-Remaining.

Ideas to try

• React with white_check_mark to mark completed tasks
• Pin key decisions or weekly status updates
• Search messages for past discussions before asking a question
• Create project-specific channels and set descriptive topics
• DM users via chat.postMessage with "channel": "@username"
• Use incoming webhooks for external system alerts without auth

For full documentation, see Rocket.Chat API Docs.