Zalo Multi Send

Send multiple images or files in a single Zalo message using zca-js directly. Use when the user asks to send multiple photos/files to a Zalo contact or group...

This skill appears to implement the stated feature, but take these precautions before installing or running it: - Inspect and fix the ZCA_PATH: the script uses a hardcoded absolute path (/home/tuan/...) to require zca-js. That path is non-portable and could cause the script to load code from an unexpected user's directory. Prefer one of: (a) update the script to require the zca-js bundled by OpenClaw via a relative/known path or environment variable (e.g., allow ZCA_PATH override), (b) vendor zca-js with the skill, or (c) confirm with the publisher the correct, canonical path. - Be aware the script reads credentials from ~/.openclaw/credentials/zalouser/credentials.json but the skill metadata didn't declare this. Confirm that the credentials file is managed by OpenClaw and contains only intended keys; do not run the script if you don't trust the credentials origin. - Review the printed JSON output before sharing it: the script logs the full API response to stdout; inspect it for any sensitive fields you don't want exposed to logs. - When testing, run the script under a limited user account or in a sandbox/container so any unexpected require() load executes in a controlled environment. - If you plan to use it regularly, ask the publisher to correct the metadata (declare the credential path) and make ZCA_PATH configurable or remove hardcoded developer-specific paths. If the publisher confirms the ZCA_PATH was a packaging mistake and provides a corrected/portable path (or an env var) and updates the metadata to declare the credential file, the concerns here would likely be resolved and confidence would increase.

Type: OpenClaw Skill Name: zalo-multi-send Version: 1.0.0 The skill contains a hardcoded absolute path to a specific user's home directory (/home/tuan/) for its core dependency (zca-js) in scripts/send.mjs, which is highly irregular for a portable skill bundle and suggests it was not designed for general use. While the logic aligns with the stated purpose of sending Zalo messages, the script's ability to read arbitrary local files and send them to a Zalo recipient poses a significant data exfiltration risk if the AI agent is prompted to access sensitive files (e.g., SSH keys or configuration files).