Latest release: v2026.7.1Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The plugin can send Zalo messages, media, links, reactions, list friends/groups, read inbound messages, and expose those actions to agents; this is high-impact account access but matches the stated Zalo Personal channel purpose and README disclosure.
Instruction Scope
Runtime behavior is scoped to the zalouser channel/tool, configured accounts, QR login, DM/group policies, allowlists, pairing, and group mention requirements; no hidden prompt manipulation or unrelated agent instructions were found.
Install Mechanism
The package is an official @openclaw plugin with a source-linked OpenClaw release, no install scripts, a shrinkwrap, and expected runtime dependencies including zca-js.
Credentials
It uses network access through zca-js and writes QR/temp files and local Zalo session credentials, which is proportionate for a QR-login messaging integration.
Persistence & Privilege
It persists Zalo cookies/IMEI/user-agent under the OpenClaw state credentials path and can run a listener while the channel is enabled; logout code clears the local session, and startup activation is not unconditional.
Scan Findings in Context
[SkillSpector] expected: No SkillSpector findings were supplied.
[staticScan] expected: Static scan reported clean, and artifact inspection found no install hooks, obfuscated execution, unrelated file access, or hidden exfiltration logic.
[VirusTotal] expected: VirusTotal telemetry was clean across supplied engines; this supports but does not determine the benign verdict.
Assessment
Install only if you are comfortable letting OpenClaw automate your Zalo personal account. Treat the saved Zalo session as sensitive, keep dmPolicy on pairing or allowlist unless you intentionally want open access, prefer numeric group/user IDs over name matching, and remember the README warns this unofficial automation may risk Zalo account suspension.Verification
Tags
@openclaw/zalouser
OpenClaw extension for Zalo Personal Account messaging via native zca-js integration.
Warning: Using Zalo automation may result in account suspension or ban. Use at your own risk. This is an unofficial integration.
Features
- Channel plugin integration with setup wizard + QR login
- In-process listener/sender via
zca-js(no external CLI) - Multi-account support
- Agent tool integration (
zalouser) - DM/group policy support
Prerequisites
- OpenClaw Gateway
- Zalo mobile app (for QR login)
No external zca, openzca, or zca-cli binary is required.
Install
Option A: npm
openclaw plugins install @openclaw/zalouser
Option B: local source checkout
PLUGIN_SRC=./path/to/local/zalouser-plugin
openclaw plugins install "$PLUGIN_SRC"
cd "$PLUGIN_SRC" && pnpm install
Restart the Gateway after install.
Quick start
Login (QR)
openclaw channels login --channel zalouser
Scan the QR code with the Zalo app on your phone.
Enable channel
channels:
zalouser:
enabled: true
dmPolicy: pairing # pairing | allowlist | open | disabled
Send a message
openclaw message send --channel zalouser --target <threadId> --message "Hello from OpenClaw"
Configuration
Basic:
channels:
zalouser:
enabled: true
dmPolicy: pairing
Multi-account:
channels:
zalouser:
enabled: true
defaultAccount: default
accounts:
default:
enabled: true
profile: default
work:
enabled: true
profile: work
Useful commands
openclaw channels login --channel zalouser
openclaw channels login --channel zalouser --account work
openclaw channels status --probe
openclaw channels logout --channel zalouser
openclaw directory self --channel zalouser
openclaw directory peers list --channel zalouser --query "name"
openclaw directory groups list --channel zalouser --query "work"
openclaw directory groups members --channel zalouser --group-id <id>
Agent tool
The extension registers a zalouser tool for AI agents.
Available actions: send, image, link, friends, groups, me, status
Troubleshooting
- Login not persisted:
openclaw channels logout --channel zalouser && openclaw channels login --channel zalouser - Probe status:
openclaw channels status --probe - Name resolution issues (allowlist/groups): use numeric IDs or exact Zalo names
Credits
Built on zca-js.