Security audit

ZaloClaw

Security checks for vulnerabilities and agentic risk

Overview

This Zalo channel plugin mostly does what it says, but it also gives the agent administrative control over the host plugin and stores/recalls group chat history, so it needs careful review before installation.

Install only if you are comfortable giving an AI-connected tool broad control over a personal Zalo account and the local OpenClaw gateway. Disable or tightly restrict self-update/channel-control actions, keep passiveCollector off unless every affected group understands local logging, use allowlists and group tool policies, and treat downloaded attachments as untrusted files.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:4741
Evidence: const pull = execSync("git pull origin main 2>&1", { cwd: pluginDir, encoding: "utf-8", timeout: 3e4 });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/tools/tool.ts:489
Evidence: const pull = execSync("git pull origin main 2>&1", { cwd: pluginDir, encoding: "utf-8", timeout: 30_000 });

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: dist/index.js:31
Evidence: const raw = readFileSync(CREDENTIALS_PATH, "utf-8");