add-matrix
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads a pinned dependency
@beeper/chat-adapter-matrix@0.2.0from a standard registry (NPM) and instructs the agent to fetch the adapter implementation from thechannelsbranch of the host project. - [COMMAND_EXECUTION]: Executes a Node.js one-liner to patch ESM extensions within the
node_modulesdirectory. This script performs a regex-based search-and-replace ondist/index.jsto fix missing.jsextensions in imports frommatrix-js-sdk, which is a documented workaround for Node 22 compatibility. - [CREDENTIALS_UNSAFE]: The skill guides the user to set up Matrix credentials (
MATRIX_PASSWORD,MATRIX_ACCESS_TOKEN). It follows best practices by usingprompt secretfor sensitive inputs and recommending environment variable storage (.env) rather than hardcoding. No actual secrets are included in the skill files;apply-fixtures.jsoncontains only placeholder values for testing purposes. - [DYNAMIC_EXECUTION]: The patch script uses
fs.writeFileSyncto modify a dependency file at runtime. This is targeted to a specific file within the@beeper/chat-adapter-matrixpackage and does not incorporate untrusted external input into the execution logic.
Audit Metadata