中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 18/100
Last scan:21 hr ago Rescan
18 /100
zentao-api
调用禅道（ZenTao）RESTful API v2.0 完成用户请求，覆盖项目集、产品、项目、执行、需求、Bug、任务、测试用例等20个模块的增删改查及状态流转操作
A legitimate ZenTao API wrapper skill with documented filesystem token caching and shell script execution, carrying minor security concerns around plaintext password exposure in process arguments.
Skill Namezentao-api
Duration34.1s
Enginepi
✓
Safe to install
Accept for use. Consider warning users that passwords appear in process arguments and that cached tokens are stored in plaintext on disk.

Findings 3 items

Severity Finding Location
Medium
Plaintext password visible in process arguments Credential Theft
When ZENTAO_PASSWORD is provided via environment variables, the bash script passes it directly to curl's -d argument. This causes the password to appear in /proc/PID/cmdline and in process listings (ps aux), exposing it to other processes or users on shared systems.
-d "{\"account\": \"${ZENTAO_ACCOUNT}\", \"password\": \"${ZENTAO_PASSWORD}\"}"
→ Use a here-document or pipe to avoid password in command line, e.g., echo '{"account":"...","password":"..."}' | curl -s -X POST -H 'Content-Type: application/json' -d @- ...
 scripts/get-token.sh:74
Low
Permanent token cached in plaintext on filesystem Sensitive Access
The script writes ZENTAO_TOKEN (which is permanent per ZenTao design), ZENTAO_URL, and ZENTAO_ACCOUNT to ~/.zentao-token.json in plaintext. If the filesystem is compromised, these credentials can be reused without re-authentication.
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
→ File permissions should be set to 600 (chmod 600 ~/.zentao-token.json). Consider noting this in documentation.
 scripts/get-token.sh:81
Low
SKILL.md does not disclose credential caching to disk in the prominent configuration section Doc Mismatch
The configuration section of SKILL.md describes environment variable and direct token usage but only mentions '写入 ~/.zentao-token.json' in passing within the auth flow section rather than prominently in the configuration table. A user reading only the top of the document may not realize credentials are persisted to disk.
首次登录后 `ZENTAO_URL`、`ZENTAO_TOKEN`、`ZENTAO_ACCOUNT` 写入 `~/.zentao-token.json`，后续无需重复设置
→ Add ~/.zentao-token.json to the configuration table with a note about automatic persistence.
 SKILL.md:13
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned SKILL.md writes ~/.zentao-token.json
Shell WRITE WRITE ✓ Aligned SKILL.md runs eval "$(bash scripts/get-token.sh)"
Network READ READ ✓ Aligned REST API calls to ZENTAO_URL/api.php/v2 endpoints
Environment READ READ ✓ Aligned Reads ZENTAO_URL, ZENTAO_TOKEN, ZENTAO_ACCOUNT, ZENTAO_PASSWORD from env
Clipboard NONE NONE —
Browser NONE NONE —
Database NONE NONE —
Skill Invoke NONE NONE —
3 findings
🔗
Medium External URL 外部 URL
http://zentao.example.com
SKILL.md:14
🔗
Medium External URL 外部 URL
https://www.zentao.net/book/api/2309.html
SKILL.md:207
🔗
Medium External URL 外部 URL
https://www.zentao.net/book/api/1397.html
SKILL.md:208

File Tree

3 files · 31.2 KB · 745 lines
Markdown 2f · 644L Shell 1f · 101L
├─ ▾ 📁 scripts
│ └─ 🔑 get-token.sh ⚠ Shell 101L · 4.4 KB
├─ 📝 api-reference.md Markdown 436L · 16.8 KB
└─ 📝 SKILL.md Markdown 208L · 9.9 KB

Security Positives

✓ No obfuscation or base64-encoded payloads found
✓ No unauthorized network exfiltration or C2 communication
✓ No access to sensitive paths outside the documented cache file (~/.zentao-token.json)
✓ No credential harvesting beyond what is necessary for the ZenTao API
✓ API operations are limited to the declared ZenTao REST API endpoints only
✓ No hidden instructions or prompt injection detected
✓ Shell script dependencies (curl, node) are standard tools with no malicious behavior
✓ No supply chain risks identified; no external dependencies or package managers used