Security audit
Openclaw N8n Facebook Poster
Security checks across malware telemetry and agentic risk
Overview
This plugin appears to do what it claims—collect Zalo messages/images and send drafted posts to an n8n webhook—but users should understand that images are uploaded to Telegraph and the webhook can be any HTTP URL set by the chat admin.
This looks internally coherent for a Zalo drafting plugin that forwards posts to n8n. Before installing, make sure you trust the Zalo chat environment: the first slash-command user can become plugin admin, admins can set any HTTP webhook URL, and images are uploaded to the public Telegraph service before being sent to n8n. Also note that the provided index.js source was truncated in the review data, so a final decision should include checking the complete file.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.