skills/nanocoai/nanoclaw/add-matrix/Gen Agent Trust Hub

add-matrix

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads a pinned dependency @beeper/chat-adapter-matrix@0.2.0 from a standard registry (NPM) and instructs the agent to fetch the adapter implementation from the channels branch of the host project.
  • [COMMAND_EXECUTION]: Executes a Node.js one-liner to patch ESM extensions within the node_modules directory. This script performs a regex-based search-and-replace on dist/index.js to fix missing .js extensions in imports from matrix-js-sdk, which is a documented workaround for Node 22 compatibility.
  • [CREDENTIALS_UNSAFE]: The skill guides the user to set up Matrix credentials (MATRIX_PASSWORD, MATRIX_ACCESS_TOKEN). It follows best practices by using prompt secret for sensitive inputs and recommending environment variable storage (.env) rather than hardcoding. No actual secrets are included in the skill files; apply-fixtures.json contains only placeholder values for testing purposes.
  • [DYNAMIC_EXECUTION]: The patch script uses fs.writeFileSync to modify a dependency file at runtime. This is targeted to a specific file within the @beeper/chat-adapter-matrix package and does not incorporate untrusted external input into the execution logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 02:00 AM
Security Audit — agent-trust-hub — add-matrix