Security audit
Zalo
Security checks for vulnerabilities and agentic risk
Overview
This package is a disclosed Zalo messaging channel plugin whose token, webhook, network, and local state behavior matches its stated purpose.
Before installing, confirm you intend to connect OpenClaw to a Zalo bot account. Treat the bot token and webhook secret as credentials, prefer scoped secret storage or environment variables, and review dmPolicy/groupPolicy/allowFrom settings because open policies can allow more Zalo users or group members to reach the agent.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.