Security audit
Zalo
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Zalo channel plugin that uses configured bot credentials and webhooks to send and receive Zalo messages, with no hidden or purpose-mismatched behavior found.
Install this only when you intend to connect OpenClaw to a Zalo bot. Protect the bot token and webhook secret, keep pairing or allowlists enabled unless broader access is intentional, and verify webhook, proxy, and API URL settings because the plugin can set or clear the bot webhook and send messages through the configured account.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.