Security audit
Zalo
Security checks for vulnerabilities and agentic risk
Overview
The plugin’s bot credentials, messaging access, and webhook processing fit its stated purpose of connecting OpenClaw to Zalo.
Use a dedicated bot, protect its token, and keep pairing or sender allowlists enabled. Webhook mode requires HTTPS and a strong secret; it stores incoming events locally and may briefly host outgoing images. Starting polling can remove an existing bot webhook. Keep the default API endpoint unless you trust the replacement.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.