Latest release: v2026.10.6Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidenceCredentials
Configured Matrix credentials and homeserver access support the integration. Reviewed networking code applies destination checks and strips authorization on cross-origin redirects.
Install Mechanism
Uses the standard OpenClaw plugin installation route and pinned direct dependencies. Encryption initialization can run the crypto dependency’s native-binding downloader with a five-minute timeout.
Instruction Scope
No bundled skills or evaluator-directed instructions were found. SkillSpector’s not-applicable result is consistent with the package.
Persistence & Privilege
Retains account-specific credentials, crypto state, and conversation bindings. Monitoring follows host cancellation; bindings support expiration and removal, and approvals restrict authorized users.
Purpose & Capability
Supports messaging, message edits/deletion, profiles, encryption, and approvals, with configurable action gates and target authorization.
Assessment
Use a dedicated bot account, restrict allowed rooms and senders, and grant only needed room permissions. The plugin can edit/delete messages and retains sensitive account state locally. Send approval prompts only to trusted recipients. See the [Matrix access-control guide](https://docs.openclaw.ai/channels/matrix/access-control).node_modules/matrix-js-sdk/lib/crypto-api/index.d.ts:1083
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/crypto-api/index.js.map:1
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/embedded.js.map:1
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/http-api/fetch.js.map:1
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/interactive-auth.d.ts:44
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/lib/oauth/tokenRefresher.js.map:1
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/src/crypto-api/index.ts:1265
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/src/interactive-auth.ts:75
File appears to expose a hardcoded API secret or token.
node_modules/matrix-js-sdk/node_modules/another-json/spec/another-json-spec.js:43
Potential obfuscated payload detected.
node_modules/matrix-js-sdk/node_modules/sdp-transform/lib/grammar.js:272
Potential obfuscated payload detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.Verification
Tags
OpenClaw Matrix
Official OpenClaw channel plugin for Matrix rooms and direct messages.
Install from OpenClaw:
openclaw plugins install @openclaw/matrix
Configure the Matrix homeserver and bot credentials in OpenClaw. The plugin lets agents join configured rooms, receive messages, and reply through Matrix.