Security audit

Zalo Agent CLI

Security checks across malware telemetry and agentic risk

Overview

This Zalo automation skill is coherent, but it needs review because it can read and forward private messages, expose login/webhook/MCP endpoints, store sensitive logs and credentials, and send account messages with limited safety guidance.

Review carefully before installing. Use it only with accounts and Official Accounts you control, require explicit confirmation before sending messages or exporting credentials, avoid broad history searches, prefer localhost or authenticated HTTPS endpoints, do not use --no-verify on exposed webhooks, protect credential and log files, and avoid forwarding message payloads to third-party automation services unless users have approved that data flow.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list is unusually broad for a high-impact skill that can send messages, export credentials, start webhooks, and expose an MCP server. Broad phrases like 'official account', 'bank card', 'QR transfer', and 'MCP server' increase the chance of accidental invocation in unrelated conversations, which can lead to unintended execution of sensitive operations or disclosure-oriented guidance.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents sensitive capabilities including message history access, webhook forwarding, bank/QR payment sharing, OA operations, and credential export, but it does not present prominent user-facing warnings or consent requirements before privacy-impacting actions. In practice, this can normalize high-risk operations and make users unaware that messages, contact data, or credentials may be exposed to external endpoints or transferred off-host.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide encourages forwarding full message and event payloads, including message content and identifiers, to arbitrary webhook endpoints without any warning about sensitive data handling, transport security, or third-party exposure. In this skill context, the listener is explicitly designed for real-time monitoring of private chats and account events, so silent exfiltration to automation platforms materially increases privacy and data leakage risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The JSONL save mode documents persistent per-thread logging of event data without warning users that this creates local archives of private messages and social graph activity. Because this skill handles Zalo messages, groups, and friend events, local retention can expose sensitive communications through disk compromise, backups, shared hosts, or mishandled log directories.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: Documenting automatic acceptance of friend requests without caution can lead users to weaken account trust boundaries and unintentionally admit spam, impersonators, or unwanted contacts. In a messaging automation skill, this is more dangerous than a generic CLI flag because it directly affects account exposure and can expand the set of parties able to interact with the automated account.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The instructions explicitly determine the server's public IP, start a QR login HTTP server, and tell the user to open it remotely while also recommending firewall exposure. That creates unnecessary network exposure for a sensitive authentication flow, increasing the chance that other parties on the network can access, capture, or interfere with the QR login endpoint if it is bound beyond localhost or exposed on an untrusted host.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation exposes tools that can send Zalo messages and open local media using the system viewer without warning about external side effects, privacy exposure, or the need for user confirmation. In an MCP/agent context, these are action-taking capabilities that can cause unintended communication, metadata leakage, or unsafe opening of untrusted files if invoked too casually.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide documents history retrieval and cross-thread search capabilities over previously collected messages but provides no privacy or least-privilege warning. In this skill context, searching across all threads can expose sensitive personal or group conversations far beyond the user’s immediate intent, increasing the risk of over-collection, accidental disclosure, and misuse by downstream agents.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document instructs users to pass `--secret <KEY>` and access tokens directly on the command line, which can expose sensitive values through shell history, terminal logging, CI logs, and process inspection by other local users. In an automation-oriented skill explicitly supporting AI agents and CI, this omission materially increases the chance of credential leakage.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The reference states that app credentials, access tokens, and refresh tokens are stored locally in `~/.zalo-agent/oa-credentials.json` but does not warn users about the sensitivity of that file or the consequences of workstation compromise, backups, or accidental inclusion in dotfile sync tools. Because these tokens enable OA access, local persistence expands the attack surface.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The examples include `--no-verify` for webhook listening without a strong warning that disabling MAC verification permits unauthenticated webhook payloads. If used beyond isolated development, an attacker could spoof Zalo events and trigger downstream automations, message handling, or business logic based on forged requests.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: **Expected reasoning:** 1. OA webhook → `oa listen` + ngrok tunnel 2. Start listener: `zalo-agent oa listen -p 3000 --no-verify` 3. Start tunnel: `ngrok http 3000` 4. Get ngrok URL from ngrok API or output 5. Instruct user: set webhook URL at developers.zalo.me → Webhook
Confidence: 86% confidence
Finding: The scenario instructs use of `zalo-agent oa listen -p 3000 --no-verify`, which appears to disable verification on a publicly exposed webhook listener. In the context of an ngrok-exposed OA endpoint, disabling verification can allow spoofed webhook requests or untrusted traffic to be treated as authentic, weakening trust boundaries around inbound events.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: evals/eval-scenarios.md:186