Matrix Channel Fix

修复 Matrix Channel 常见问题：加密模块安装、token 过期处理、重新登录等。 Use when: Matrix channel 无法正常工作、加密模块报错、token 失效等问题。

This SKILL.md appears to be a straightforward troubleshooting guide for the OpenClaw Matrix channel. Before running commands: back up ~/.openclaw/ and your OpenClaw configuration; confirm the homeserver URL and bot credentials; verify you have pnpm, curl, and jq installed and run commands intentionally (global pnpm add may require sudo and will modify system node_modules); avoid blindly copying rm -rf commands — ensure you target the correct path; understand that openclaw config set storing a password may persist it in plaintext in configuration; consider testing changes in a staging environment or container, and verify the package @matrix-org/matrix-sdk-crypto-nodejs from its upstream source before installing. If you need higher assurance, ask the skill author for source/homepage or a cryptographic checksum for the module to be installed.

Type: OpenClaw Skill Name: matrix-fix Version: 1.0.0 The skill is classified as suspicious due to several risky operations and poor security practices, primarily involving the handling of sensitive credentials. The `SKILL.md` instructs the agent to execute shell commands that expose passwords directly in the command line (e.g., `openclaw config set channels.matrix.password` and `curl ... -d '{"type":"m.login.password", ...}'`), which can lead to credential exposure in process lists or logs. Additionally, it uses powerful commands like `rm -rf ~/.openclaw/matrix/accounts/*` for clearing tokens and `pnpm add` for package installation, which, while intended for troubleshooting, carry inherent risks if not handled with extreme care by the agent and underlying system. There is no clear evidence of malicious intent such as data exfiltration to unauthorized endpoints or backdoor installation.