Security audit
Security checks for vulnerabilities and agentic risk
This package is a clearly disclosed Zalo personal-account channel plugin with powerful messaging and account-management abilities that fit its stated purpose, but users should configure access tightly.
Install only if you intend to let OpenClaw operate a personal Zalo account. Keep DM and group policies restrictive at first, prefer allowlists and require-mention groups, do not share the credential files, and be cautious enabling broad agent access or sibling plugins because the tool can send messages and perform administrative account/group actions.
SkillSpector was not run because this plugin release contains no bundled skills.
Detected: suspicious.env_credential_access
var debug = typeof process === "object" && process.env && void 0 ? (...args) => console.error("SEMVER", ...args) : () => {