Security audit
Zalo Personal
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Zalo Personal Account messaging plugin that clearly discloses QR login, local session storage, contact/group lookup, and message sending.
Install only if you accept using an unofficial Zalo automation integration with your personal account. Keep dmPolicy and groupPolicy restrictive unless you intentionally want open access, review which agents can use the zalouser tool, and use the logout command to clear the saved local session when finished.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.