Security audit

OpenClaw Zalo Mod

Security checks for vulnerabilities and agentic risk

Overview

The plugin provides the advertised Zalo controls, but safety flaws can bypass restrictions on destructive actions and expose dashboard access.

Prefer a corrected release that prevents nested parameters from changing the validated action and authenticates dashboard access on every reachable interface. Leaving destructive actions disabled does not prevent the confirmed bypass. For testing, use a noncritical Zalo account and isolate the dashboard from other machines and containers. Messages and contacts are retained locally, and summary features send relevant text to the configured AI provider.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

The skill exposes general Zalo account and group administration beyond the manifest's plugin controls and dashboard actions.

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: The manifest describes bot configuration, chat summaries, kanban operations, and dashboard actions. This section explicitly introduces operations that have no dashboard button through a roughly 141-action zalo-api gateway, including changing the bot profile, adding or removing deputy group administrators, and renaming groups; the executable tool-call example demonstrates the broader scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.