Verify Matrix device

Verify and cross-sign the active Matrix device for one OpenClaw-managed account. Use when a user needs to repair trust for an OpenClaw Matrix device, confirm...

This skill appears to do what it claims, but review and run it with these precautions: 1) Inspect the included scripts locally (they are provided) and confirm the homeserver you supply is correct. 2) Be aware the script will read your openclaw.json (default ~/.openclaw/openclaw.json or path from OPENCLAW_JSON) to obtain access tokens — only use this skill if you trust the repository/run context. 3) npm install will fetch dependencies from the public npm registry into the skill folder; consider running installs in an isolated environment (container or VM) and run npm audit if desired. 4) Provide recovery keys, access tokens, or passwords only interactively in a secure terminal as instructed. 5) If you need greater assurance, run the scripts in a sandbox and verify network requests (they target only the homeserver you provide and Matrix endpoints).

Type: OpenClaw Skill Name: verify-matrix-device Version: 0.1.0 The skill's core functionality involves securely handling sensitive Matrix credentials (access tokens, passwords, recovery keys) and performing cryptographic operations to verify and cross-sign a Matrix device, which aligns with its stated purpose. However, the `SKILL.md` instructions for the OpenClaw agent to execute `node {baseDir}/scripts/verify_matrix_device.mjs` with user-provided `--homeserver` and `--username` arguments create a shell injection vulnerability. If the OpenClaw agent does not properly sanitize these user inputs before constructing and executing the shell command, an attacker could achieve Remote Code Execution (RCE) on the host system. This is a critical vulnerability in the agent's execution model, not an intentional malicious act by the skill itself, thus classifying it as suspicious.