zalo-mini-app — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited zalo-mini-app (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build Mini Apps for the Zalo platform using React, ZaUI, zmp-sdk, Zalo Mini App CLI/Extension, and platform Open APIs.
Docs baseline: official Zalo Mini App docs checked on 2026-06-24.
npm install -g zmp-cli
zmp create my-app
cd my-app
zmp startCore packages:
npm install zmp-ui zmp-sdkimport { App, Page, Button, Input, Modal } from "zmp-ui";
import "zmp-ui/zaui.css";
import { getUserInfo, authorize } from "zmp-sdk/apis";Current package versions observed on 2026-06-24:
zmp-sdk: 2.51.xzmp-ui: 1.11.xzmp-cli: 4.0.xAlways verify package types in the installed project when implementing exact props or SDK return types.
import { getPhoneNumber } from "zmp-sdk/apis";
const { token } = await getPhoneNumber({});
// Send token to backend immediately.
// Backend exchanges token with Zalo Open API to get the actual phone number.
// Token is single-use and short-lived.Do not expect getPhoneNumber to return { number } in current docs.
import { getLocation } from "zmp-sdk/apis";
const { token } = await getLocation();
// Send token to backend for Zalo Open API exchange.Do not expect getLocation to return direct { latitude, longitude } in current docs.
import { LFSStorage } from "zmp-sdk/apis";
const { support } = await LFSStorage.isSupportLFS();
const { savedPath } = await LFSStorage.saveFile({ filePath: "local-temp-path" });Use filePath / savedPath, not old tempFilePath helpers.
import { openMediaPicker } from "zmp-sdk/apis";
const { data } = await openMediaPicker({
type: "photo",
maxSelectItem: 5,
serverUploadUrl: "https://example.com/upload"
});Use maxSelectItem, not maxSelection.
import { App, Page, Header, List, Icon, BottomNavigation } from "zmp-ui";
export default function Root() {
return (
<App>
<Page>
<Header title="Home" />
<List>
<List.Item title="Item" suffix={<Icon icon="zi-chevron-right" />} />
</List>
</Page>
<BottomNavigation fixed>
<BottomNavigation.Item key="home" label="Home" icon={<Icon icon="zi-home" />} />
</BottomNavigation>
</App>
);
}~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.