Zalo Multi Send

• Analyzed: May 15, 2026, 6:15 AM
• Findings: 1
• Version: 1.0.0
• Hash: 88bbc2b158de39b28414b56266c9befbcfd99e70c00250d0f19e3b51d4e011a4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a hardcoded absolute path to a specific user's home directory (/home/tuan/) for its core dependency (zca-js) in scripts/send.mjs, which is highly irregular for a portable skill bundle and suggests it was not designed for general use. While the logic aligns with the stated purpose of sending Zalo messages, the script's ability to read arbitrary local files and send them to a Zalo recipient poses a significant data exfiltration risk if the AI agent is prompted to access sensitive files (e.g., SSH keys or configuration files).