Security audit

OpenClaw Zalo Mod

Security checks for vulnerabilities and agentic risk

Overview

This is a powerful but disclosed Zalo administration plugin, and the reviewed artifacts did not show hidden exfiltration, deception, or unsafe automatic destructive behavior.

Install this only if you want the OpenClaw owner/agent to manage Zalo groups and related local chat/CRM data. Keep the dashboard bound to localhost or protected with a strong token, review stored chat/contact data expectations, and do not enable agentTools.allowDestructive unless you intentionally want irreversible Zalo actions available.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The documented generic pass-through to roughly 141 `zalo-connect` actions effectively turns the skill into a natural-language wrapper over a large administrative API surface. Even with some stated safety gating, this is dangerous because it enables broad capability expansion, raises prompt-to-action abuse risk, and makes it much harder to reason about what operations the skill may perform, including potentially destructive or privacy-sensitive actions if policy checks are incomplete or bypassed.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The manifest description is entirely in Vietnamese and presents the skill as operating through natural language without indicating that language is configurable or limited by design. This can violate language/locale policy because it implicitly forces a specific language for users who may not have opted into Vietnamese-only behavior.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill’s documented scope expands from Zalo Mod dashboard/configuration control into broad Zalo account and group administration, including actions like renaming groups, changing group images, modifying deputies, polls, reminders, and bot profile operations. In a natural-language admin skill, this scope creep increases the chance of unintended or over-privileged actions and weakens the principle of least privilege, especially because users may not realize they are authorizing much broader account-level capabilities.

Static analysis

No suspicious patterns detected.