Zalo Multi Send
PassAudited by ClawScan on May 10, 2026.
Overview
This skill appears to do its stated job, but it uses your stored Zalo login to send the files or URLs you specify, so recipients and attachments should be checked carefully.
This skill is reasonable for sending multiple attachments through Zalo, but treat it as account-authorized messaging software. Before installing or running it, confirm you trust the skill, verify the hard-coded zca-js path on your machine, and double-check the Zalo recipient ID, group flag, credential profile, and every file or URL being sent.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If run with the wrong arguments or by an untrusted agent, it can send messages from your Zalo account.
The script reads a stored Zalo credential profile and logs in with cookie/session-like material to act as the user's Zalo account.
const creds = JSON.parse(readFileSync(credsPath, "utf-8")); ... await zalo.login({ imei: creds.imei, cookie: creds.cookie, userAgent: creds.userAgent, language: creds.language });Install only if you trust this skill with your Zalo account session, and verify the recipient, group flag, profile, and attachments before sending.
A mistaken recipient ID, group flag, or file path could send private content to the wrong chat.
When invoked, the script directly sends the provided caption and attachments to the specified Zalo user or group without a built-in confirmation step.
const result = await api.sendMessage(
{ msg: args.caption, attachments },
args.to,
threadType
);Use an explicit confirmation workflow before running the script, especially for group messages or sensitive files.
Selected file contents leave the local machine and are delivered through Zalo to the chosen recipient or group.
The script loads local files or fetched URL contents into attachments that are then sent through Zalo to a numeric user or group ID.
const { buf, name } = await loadFile(src); ... return { data: buf, filename: safeName, metadata: { totalSize: buf.length } };Check that each file or URL is intended to be shared and that the numeric Zalo recipient ID is correct.
The skill may fail on other systems or run whatever zca-js code exists at that local path.
The script loads zca-js from a hard-coded absolute path outside the skill package rather than declaring or pinning the dependency in an install spec.
const ZCA_PATH =
"/home/tuan/.nvm/versions/node/v22.21.1/lib/node_modules/openclaw/extensions/zalouser/node_modules/zca-js";
const { Zalo, ThreadType } = require(ZCA_PATH);Verify the zca-js path before use, and prefer a declared, pinned dependency or a documented OpenClaw-provided module path.