Security audit
Zalo
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Zalo messaging channel plugin that uses the expected tokens, webhooks, polling, and outbound API calls needed for that purpose.
Before installing, confirm you intend to let OpenClaw send and receive Zalo messages using the configured bot token. Prefer secret-store or environment-based token handling, restrict dmPolicy/groupPolicy and allowFrom/groupAllowFrom for production use, and only enable webhook mode with an HTTPS URL and strong webhook secret.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.