RocketChat

Rocket.Chat team messaging - channels, messages, users, integrations via REST API

This skill is coherent with its description: it will use the RC_URL, RC_TOKEN and RC_USER_ID you provide to call Rocket.Chat REST endpoints (read/post/edit messages, manage channels/users depending on token privileges). Because the skill is instruction-only (no installer), it won't drop code on disk, but any agent using this skill will be able to act with the permissions of the supplied token. Before installing, consider using a dedicated bot/service account with minimal required permissions (avoid full admin tokens unless necessary), restrict the token's scope and rotate it regularly, and ensure RC_URL points to a trusted Rocket.Chat instance. Also review the agent's actions when it runs (or disable autonomous invocation if you want manual control). The regex scanner found no code to analyze, which is expected for an instruction-only skill.

Type: OpenClaw Skill Name: rocketchat Version: 1.0.2 The skill bundle provides a set of `curl` commands to interact with the Rocket.Chat REST API, as described in `SKILL.md`. All commands are directed at the user-configured `$RC_URL` and use the provided `$RC_TOKEN` and `$RC_USER_ID` for authentication. There is no evidence of prompt injection attempts against the agent, unauthorized data exfiltration, persistence mechanisms, or execution of arbitrary remote code. The examples demonstrate standard API functionality, including potentially powerful actions like creating users, but these are legitimate capabilities of the Rocket.Chat API and not indicative of malicious intent within the skill itself.