Security audit
Security checks across malware telemetry and agentic risk
This is a real Zalo administration plugin with disclosed features, but it stores broad chat/contact data locally and can perform powerful group and messaging actions, so it belongs in Review before installation.
Install only if you are comfortable giving this plugin owner-level Zalo group administration, local dashboard access, and local storage of chat/contact history. Keep the dashboard bound to localhost or use a strong token, review `pendingAuto`, report delivery, CRM import, and `agentTools.allowDestructive` settings, and treat `context.db`, profile caches, and memory files as sensitive data.
// ── Auto-duyệt member chờ (pendingAuto) — CHỈ khi bot là admin nhóm; lọc theo từ khoá tên ──
// Lọc: pluginCfg.pendingBlockKeywords (mảng) — tên chứa từ khoá này thì BỎ QUA (không duyệt).
async function autoApprovePending() {
const withZaloApi = await getSafeZaloApi();
if (!withZaloApi) return;
const blockKw = (pluginCfg.pendingBlockKeywords || []).map(s => String(s).toLowerCase()).filter(Boolean);// Auto-duyệt member chờ — mỗi ~2 phút (throttle toàn cục, tránh gọi API dày).
if (Date.now() - (globalThis.__zmPendLast || 0) > 120000) {
globalThis.__zmPendLast = Date.now();
await autoApprovePending();
}
} catch (e) {
logger.warn(`[openclaw-zalo-mod] [pendingAuto] scan error: ${e.message}`);}
},
"peerDependencies": {
"openclaw": "*"
},
"scripts": {
"check": "node --check index.js",61/61 vendors flagged this plugin as clean.
No suspicious patterns detected.