Security audit
Security checks across malware telemetry and agentic risk
This is a disclosed Zalo personal-account connector, but it exposes very broad authenticated account control and a same-process bridge that other plugins can use, so it belongs in Review.
Install only if you intend to let OpenClaw operate a personal Zalo account with broad messaging, group administration, profile, contact, and conversation-management authority. Use a patched OpenClaw host, restrict DM/group policies and tool permissions, avoid enabling passive collection unless you want local group history logs, and install only alongside sibling plugins you trust because they can use the exposed bridge to act through the authenticated Zalo account.
SkillSpector was not run because this plugin release contains no bundled skills.
60/60 vendors flagged this plugin as clean.
Detected: suspicious.env_credential_access
var debug = typeof process === "object" && process.env && void 0 ? (...args) => console.error("SEMVER", ...args) : () => {