agent-manager
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages sensitive credentials with weaknesses. The setup_agent.sh script generates predictable passwords for new Matrix accounts using a hardcoded suffix ('20260205openclaw'). Furthermore, config_manager.py stores Matrix accessToken values in plaintext in the ~/.openclaw/openclaw.json configuration file.
- [COMMAND_EXECUTION]: Sensitive information is passed via command-line arguments to shell and Python scripts, which can lead to exposure in system process lists or shell history. Additionally, matrix_register.sh executes curl commands to communicate with external Matrix homeservers for account registration and authentication.
Audit Metadata