{"data":{"skill":{"slug":"ariesyb-zentao-task-planner","name":"zentao-task-planner","icon":"📦","repo":"https://github.com/ariesyb/zentao-ai-agent/tree/db40ebacf4d7a68e17661436152c2469a0103d0e/skills/zentao-task-planner","status":"approved","author":"ariesyb","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"90220054-b7c9-41bb-a115-2b78da8ddaa4","skill_id":"8a93d79f-e67e-48c5-b4c4-73cfb58944f4","version":7,"content_hash":"v3:7b0e7cf67446844ab9bf2218247856d49e498720:fb6b576977c6f2f6b5904894c8a626b2fc2f581ad5e0fee02d6711cbd4d80970:afc5d033c22f74da47585ff696d6e33d447d7d81a3b6ed1b9dede4277ef39dde:736b696c6c732f617269657379622f7a656e74616f2d7461736b2d706c616e6e6572:8b96a4f83a787e438257bf00d5cef67e","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"Most static alerts are false positives caused by Markdown formatting, Chinese text entropy, local configuration documentation, and ordinary Zentao identifier parsing. The client has two confirmed transport risks: it permits plaintext HTTP and does not enforce its origin boundary across redirects.","remediation":[{"issue":"Zentao credentials may be sent over plaintext HTTP.","severity":"high","suggestion":"Require an HTTPS base URL, with an explicit local-development exception that never accepts production credentials."},{"issue":"Automatic redirects are not checked against the configured Zentao origin.","severity":"high","suggestion":"Disable redirects for authenticated requests or validate every redirect target by parsed scheme, hostname, port, and path before following it."}],"risk_factor_evidence":[{"factor":"network","evidence":[{"file":".env.example","line_end":2,"line_start":2},{"file":"references/commands.md","line_end":8,"line_start":8},{"file":"scripts/zentao_common.py","line_end":17,"line_start":17},{"file":"scripts/zentao_common.py","line_end":386,"line_start":386},{"file":"scripts/zentao_common.py","line_end":433,"line_start":433}]},{"factor":"filesystem","evidence":[{"file":"references/commands.md","line_end":20,"line_start":20},{"file":"references/commands.md","line_end":28,"line_start":28},{"file":"references/get-task-types.md","line_end":24,"line_start":24}]},{"factor":"env_access","evidence":[{"file":"references/commands.md","line_end":25,"line_start":25},{"file":"scripts/zentao_common.py","line_end":165,"line_start":165},{"file":"scripts/zentao_common.py","line_end":166,"line_start":166},{"file":"scripts/zentao_common.py","line_end":167,"line_start":167},{"file":"scripts/zentao_common.py","line_end":165,"line_start":165},{"file":"scripts/zentao_common.py","line_end":166,"line_start":166},{"file":"scripts/zentao_common.py","line_end":167,"line_start":167},{"file":"scripts/zentao_common.py","line_end":16,"line_start":16},{"file":"scripts/zentao_common.py","line_end":146,"line_start":146},{"file":"scripts/zentao_common.py","line_end":16,"line_start":16},{"file":"scripts/zentao_common.py","line_end":146,"line_start":146},{"file":"SECURITY.md","line_end":25,"line_start":25}]},{"factor":"scripts","evidence":[{"file":"scripts/create_tasks.py","line_end":12,"line_start":7}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":12,"line_start":12},{"file":"SKILL.md","line_end":15,"line_start":15},{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":18,"line_start":18},{"file":"SKILL.md","line_end":19,"line_start":19},{"file":"SKILL.md","line_end":20,"line_start":20},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":47,"line_start":47}]}],"critical_findings":[],"high_findings":[{"title":"Plain HTTP Can Expose Zentao Credentials","locations":[{"file":"scripts/zentao_common.py","line_end":183,"line_start":181},{"file":"scripts/zentao_common.py","line_end":416,"line_start":411}],"confidence":0.99,"description":"The client accepts HTTP base URLs, then submits the Zentao account and password to the login endpoint without transport encryption.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The scheme check explicitly permits http://, and the login method directly posts both credential fields to that configured origin."},{"title":"Redirects Can Bypass the Configured Network Boundary","locations":[{"file":"scripts/zentao_common.py","line_end":416,"line_start":403}],"confidence":0.94,"description":"Requests follows redirects by default, but the client validates only the initial URL. A cross-origin redirect can leave the configured Zentao origin.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"The initial URL receives a prefix check, while the session request does not disable redirects or validate the final response URL and redirect history."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":20,"total_lines":2191,"audit_model":"codex","audited_at":"2026-08-20T01:25:21.729+00:00","created_at":"2026-08-20T02:20:13.903585+00:00","static_findings":[{"id":"network:.env.example:2:hardcoded-url","file":".env.example","pattern":"Hardcoded URL","snippet":"ZENTAO_BASE_URL=https://your-zentao-instance.com/zentao/","category":"network","line_end":2,"severity":"low","line_start":2},{"id":"sensitive:.env.example:1:environment-file-access","file":".env.example","pattern":"Environment file access","snippet":"# 复制为 .env 后填写真实值。.env 只保存在本机,不要提交到 git,也不要打进技能包。","category":"sensitive","line_end":1,"severity":"high","line_start":1},{"id":"sensitive:references/close-tasks.md:12:environment-file-access","file":"references/close-tasks.md","pattern":"Environment file access","snippet":"- `--env-file`:技能包或本地的 `.env` 文件路径","category":"sensitive","line_end":12,"severity":"high","line_start":12},{"id":"network:references/commands.md:8:hardcoded-url","file":"references/commands.md","pattern":"Hardcoded URL","snippet":"ZENTAO_BASE_URL=https://your-zentao-instance.com/zentao/","category":"network","line_end":8,"severity":"low","line_start":8},{"id":"filesystem:references/commands.md:20:path-traversal-sequence","file":"references/commands.md","pattern":"Path traversal sequence","snippet":"- 详见 [../SECURITY.md](../SECURITY.md)。","category":"filesystem","line_end":20,"severity":"high","line_start":20},{"id":"filesystem:references/commands.md:28:hidden-file-access","file":"references/commands.md","pattern":"Hidden file access","snippet":"脚本默认读取 `skills/zentao-task-planner/.env`,推荐存放到该目录,方便下次使用,也可通过 `--env-file` 指定。","category":"filesystem","line_end":28,"severity":"medium","line_start":28},{"id":"env_access:references/commands.md:25:dotenv-library","file":"references/commands.md","pattern":"dotenv library","snippet":"pip install requests beautifulsoup4 python-dotenv chinese-calendar","category":"env_access","line_end":25,"severity":"low","line_start":25},{"id":"sensitive:references/commands.md:5:environment-file-access","file":"references/commands.md","pattern":"Environment file access","snippet":"操作禅道必填变量(优先读取进程环境变量,其次读取 `.env` 文件):","category":"sensitive","line_end":5,"severity":"high","line_start":5},{"id":"sensitive:references/commands.md:17:environment-file-access","file":"references/commands.md","pattern":"Environment file access","snippet":"- 推荐通过环境变量注入凭据;`.env` 只是本地便利选项,可通过 `--env-file` 指定路径。","category":"sensitive","line_end":17,"severity":"high","line_start":17},{"id":"sensitive:references/commands.md:18:environment-file-access","file":"references/commands.md","pattern":"Environment file access","snippet":"- `.env` 只保存在本机并加入 `.gitignore`,绝不能提交到仓库或打进技能包(技能包内只提供 `.env.example` 模板)。","category":"sensitive","line_end":18,"severity":"high","line_start":18},{"id":"sensitive:references/commands.md:28:environment-file-access","file":"references/commands.md","pattern":"Environment file access","snippet":"脚本默认读取 `skills/zentao-task-planner/.env`,推荐存放到该目录,方便下次使用,也可通过 `--env-file` 指定。","category":"sensitive","line_end":28,"severity":"high","line_start":28},{"id":"sensitive:references/commands.md:30:environment-file-access","file":"references/commands.md","pattern":"Environment file access","snippet":"规划后的任务请保存到本地和.env一个目录,下一次可以查看上次规划的任务作为参考。","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"sensitive:references/create-tasks.md:15:environment-file-access","file":"references/create-tasks.md","pattern":"Environment file access","snippet":"- `--env-file`:技能包或本地的 `.env` 文件路径","category":"sensitive","line_end":15,"severity":"high","line_start":15},{"id":"sensitive:references/finish-tasks.md:16:environment-file-access","file":"references/finish-tasks.md","pattern":"Environment file access","snippet":"- `--env-file`:技能包或本地的 `.env` 文件路径","category":"sensitive","line_end":16,"severity":"high","line_start":16},{"id":"filesystem:references/get-task-types.md:24:hidden-file-access","file":"references/get-task-types.md","pattern":"Hidden file access","snippet":"python skills/zentao-task-planner/scripts/get_task_types.py --env-file /path/to/.env","category":"filesystem","line_end":24,"severity":"medium","line_start":24},{"id":"sensitive:references/get-task-types.md:11:environment-file-access","file":"references/get-task-types.md","pattern":"Environment file access","snippet":"- `--env-file`:技能包或本地的 `.env` 文件路径","category":"sensitive","line_end":11,"severity":"high","line_start":11},{"id":"sensitive:references/get-task-types.md:24:environment-file-access","file":"references/get-task-types.md","pattern":"Environment file access","snippet":"python skills/zentao-task-planner/scripts/get_task_types.py --env-file /path/to/.env","category":"sensitive","line_end":24,"severity":"high","line_start":24},{"id":"sensitive:references/list-tasks.md:21:environment-file-access","file":"references/list-tasks.md","pattern":"Environment file access","snippet":"- `--env-file`:技能包或本地的 `.env` 文件路径","category":"sensitive","line_end":21,"severity":"high","line_start":21},{"id":"sensitive:references/plan-task.md:3:environment-file-access","file":"references/plan-task.md","pattern":"Environment file access","snippet":"首先得问清楚是这周还是下周完整的工作日,规划后的任务请保存到本地和.env一个目录,可以查看上次规划的任务作为参考,后续执行也无需反复传入任务文本。","category":"sensitive","line_end":3,"severity":"high","line_start":3},{"id":"sensitive:references/repair-finish-date.md:15:environment-file-access","file":"references/repair-finish-date.md","pattern":"Environment file access","snippet":"- `--env-file`:技能包或本地的 `.env` 文件路径","category":"sensitive","line_end":15,"severity":"high","line_start":15},{"id":"sensitive:references/repair-finish-date.md:30:environment-file-access","file":"references/repair-finish-date.md","pattern":"Environment file access","snippet":"python skills/zentao-task-planner/scripts/repair_task_finish_date.py --task-id 220603 --env-file .en","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"sensitive:references/repair-finish-date.md:36:environment-file-access","file":"references/repair-finish-date.md","pattern":"Environment file access","snippet":"python skills/zentao-task-planner/scripts/repair_task_finish_date.py --task-id 220603 --assigned-to ","category":"sensitive","line_end":36,"severity":"high","line_start":36},{"id":"blocker:references/repair-finish-date.md:30:system-reconnaissance","file":"references/repair-finish-date.md","pattern":"System reconnaissance","snippet":"python skills/zentao-task-planner/scripts/repair_task_finish_date.py --task-id 220603 --env-file .en","category":"blocker","line_end":30,"severity":"low","line_start":30},{"id":"blocker:references/repair-finish-date.md:36:system-reconnaissance","file":"references/repair-finish-date.md","pattern":"System reconnaissance","snippet":"python skills/zentao-task-planner/scripts/repair_task_finish_date.py --task-id 220603 --assigned-to ","category":"blocker","line_end":36,"severity":"low","line_start":36},{"id":"sensitive:scripts/close_finished_tasks.py:13:environment-file-access","file":"scripts/close_finished_tasks.py","pattern":"Environment file access","snippet":"parser.add_argument(\"--env-file\", help=\"技能包或本地的 .env 文件路径\")","category":"sensitive","line_end":13,"severity":"high","line_start":13},{"id":"scripts:scripts/create_tasks.py:7:dynamic-import-expression","file":"scripts/create_tasks.py","pattern":"Dynamic import() expression","snippet":"from zentao_common import (","category":"scripts","line_end":12,"severity":"medium","line_start":7},{"id":"sensitive:scripts/create_tasks.py:21:environment-file-access","file":"scripts/create_tasks.py","pattern":"Environment file access","snippet":"parser.add_argument(\"--env-file\", help=\"技能包或本地的 .env 文件路径\")","category":"sensitive","line_end":21,"severity":"high","line_start":21},{"id":"sensitive:scripts/finish_tasks_by_date.py:26:environment-file-access","file":"scripts/finish_tasks_by_date.py","pattern":"Environment file access","snippet":"parser.add_argument(\"--env-file\", help=\"技能包或本地的 .env 文件路径\")","category":"sensitive","line_end":26,"severity":"high","line_start":26},{"id":"sensitive:scripts/get_task_types.py:12:environment-file-access","file":"scripts/get_task_types.py","pattern":"Environment file access","snippet":"parser.add_argument(\"--env-file\", help=\"技能包或本地的 .env 文件路径\")","category":"sensitive","line_end":12,"severity":"high","line_start":12},{"id":"sensitive:scripts/list_tasks.py:46:environment-file-access","file":"scripts/list_tasks.py","pattern":"Environment file access","snippet":"parser.add_argument(\"--env-file\", help=\"技能包或本地的 .env 文件路径\")","category":"sensitive","line_end":46,"severity":"high","line_start":46},{"id":"sensitive:scripts/repair_task_finish_date.py:16:environment-file-access","file":"scripts/repair_task_finish_date.py","pattern":"Environment file access","snippet":"parser.add_argument(\"--env-file\", help=\"技能包或本地的 .env 文件路径\")","category":"sensitive","line_end":16,"severity":"high","line_start":16},{"id":"network:scripts/zentao_common.py:17:python-http-libraries","file":"scripts/zentao_common.py","pattern":"Python HTTP libraries","snippet":"from requests.adapters import HTTPAdapter","category":"network","line_end":17,"severity":"low","line_start":17},{"id":"network:scripts/zentao_common.py:386:python-http-libraries","file":"scripts/zentao_common.py","pattern":"Python HTTP libraries","snippet":"self.session = requests.Session()","category":"network","line_end":386,"severity":"low","line_start":386},{"id":"network:scripts/zentao_common.py:433:python-http-libraries","file":"scripts/zentao_common.py","pattern":"Python HTTP libraries","snippet":"def _parse_response_data(self, response: requests.Response) -> Dict[str, Any]:","category":"network","line_end":433,"severity":"low","line_start":433},{"id":"env_access:scripts/zentao_common.py:165:python-getenv-function","file":"scripts/zentao_common.py","pattern":"Python getenv function","snippet":"base_url = os.getenv(\"ZENTAO_BASE_URL\", \"\").strip()","category":"env_access","line_end":165,"severity":"low","line_start":165},{"id":"env_access:scripts/zentao_common.py:166:python-getenv-function","file":"scripts/zentao_common.py","pattern":"Python getenv function","snippet":"account = os.getenv(\"ZENTAO_ACCOUNT\", \"\").strip()","category":"env_access","line_end":166,"severity":"low","line_start":166},{"id":"env_access:scripts/zentao_common.py:167:python-getenv-function","file":"scripts/zentao_common.py","pattern":"Python getenv function","snippet":"password = os.getenv(\"ZENTAO_PASSWORD\", \"\").strip()","category":"env_access","line_end":167,"severity":"low","line_start":167},{"id":"env_access:scripts/zentao_common.py:165:getenv-function-call","file":"scripts/zentao_common.py","pattern":"getenv function call","snippet":"base_url = os.getenv(\"ZENTAO_BASE_URL\", \"\").strip()","category":"env_access","line_end":165,"severity":"low","line_start":165},{"id":"env_access:scripts/zentao_common.py:166:getenv-function-call","file":"scripts/zentao_common.py","pattern":"getenv function call","snippet":"account = os.getenv(\"ZENTAO_ACCOUNT\", \"\").strip()","category":"env_access","line_end":166,"severity":"low","line_start":166},{"id":"env_access:scripts/zentao_common.py:167:getenv-function-call","file":"scripts/zentao_common.py","pattern":"getenv function call","snippet":"password = os.getenv(\"ZENTAO_PASSWORD\", \"\").strip()","category":"env_access","line_end":167,"severity":"low","line_start":167},{"id":"env_access:scripts/zentao_common.py:16:dotenv-library","file":"scripts/zentao_common.py","pattern":"dotenv library","snippet":"from dotenv import load_dotenv","category":"env_access","line_end":16,"severity":"low","line_start":16},{"id":"env_access:scripts/zentao_common.py:146:dotenv-library","file":"scripts/zentao_common.py","pattern":"dotenv library","snippet":"load_dotenv(candidate, override=False)","category":"env_access","line_end":146,"severity":"low","line_start":146},{"id":"env_access:scripts/zentao_common.py:16:python-dotenv-loader","file":"scripts/zentao_common.py","pattern":"Python dotenv loader","snippet":"from dotenv import load_dotenv","category":"env_access","line_end":16,"severity":"low","line_start":16},{"id":"env_access:scripts/zentao_common.py:146:python-dotenv-loader","file":"scripts/zentao_common.py","pattern":"Python dotenv loader","snippet":"load_dotenv(candidate, override=False)","category":"env_access","line_end":146,"severity":"low","line_start":146},{"id":"obfuscation:scripts/zentao_common.py:440:unicode-escape-sequence","file":"scripts/zentao_common.py","pattern":"Unicode escape sequence","snippet":"text = response.text.strip().lstrip(\"\\ufeff\")","category":"obfuscation","line_end":440,"severity":"low","line_start":440},{"id":"sensitive:scripts/zentao_common.py:137:environment-file-access","file":"scripts/zentao_common.py","pattern":"Environment file access","snippet":"\"\"\"优先加载技能目录内的 .env。\"\"\"","category":"sensitive","line_end":137,"severity":"high","line_start":137},{"id":"sensitive:scripts/zentao_common.py:142:environment-file-access","file":"scripts/zentao_common.py","pattern":"Environment file access","snippet":"candidates.append(Path(__file__).resolve().parents[1] / \".env\")","category":"sensitive","line_end":142,"severity":"high","line_start":142},{"id":"sensitive:scripts/zentao_common.py:792:certificate-key-files","file":"scripts/zentao_common.py","pattern":"Certificate/key files","snippet":"project_id = list(projects.keys())[0]","category":"sensitive","line_end":792,"severity":"high","line_start":792},{"id":"blocker:scripts/zentao_common.py:8:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"import uuid","category":"blocker","line_end":9,"severity":"low","line_start":8},{"id":"blocker:scripts/zentao_common.py:319:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"story_id = int(story_id_str)","category":"blocker","line_end":319,"severity":"low","line_start":319},{"id":"blocker:scripts/zentao_common.py:425:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"self.session_id = response.cookies.get(\"zentaosid\")","category":"blocker","line_end":425,"severity":"low","line_start":425},{"id":"blocker:scripts/zentao_common.py:489:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"resolved_project_id = project_id","category":"blocker","line_end":489,"severity":"low","line_start":489},{"id":"blocker:scripts/zentao_common.py:494:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"resolved_project_id = int(projects[0][\"id\"])","category":"blocker","line_end":494,"severity":"low","line_start":494},{"id":"blocker:scripts/zentao_common.py:605:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"uid_match = re.search(r\"var kuid = '([a-f0-9]+)';\", response_text)","category":"blocker","line_end":605,"severity":"low","line_start":605},{"id":"blocker:scripts/zentao_common.py:731:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"effort_id = effort.get(\"id\")","category":"blocker","line_end":731,"severity":"low","line_start":731},{"id":"blocker:scripts/zentao_common.py:732:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"if effort_id is not None and str(effort_id).strip():","category":"blocker","line_end":732,"severity":"low","line_start":732},{"id":"blocker:scripts/zentao_common.py:748:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"estimate_id = cells[0]","category":"blocker","line_end":748,"severity":"low","line_start":748},{"id":"blocker:scripts/zentao_common.py:749:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"if not estimate_id.isdigit() or estimate_id in seen_ids:","category":"blocker","line_end":749,"severity":"low","line_start":749},{"id":"blocker:scripts/zentao_common.py:779:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"module_id = story_detail.get(\"module\")","category":"blocker","line_end":779,"severity":"low","line_start":779},{"id":"blocker:scripts/zentao_common.py:784:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"module_id = int(module_id)","category":"blocker","line_end":784,"severity":"low","line_start":784},{"id":"blocker:scripts/zentao_common.py:792:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"project_id = list(projects.keys())[0]","category":"blocker","line_end":792,"severity":"low","line_start":792},{"id":"blocker:scripts/zentao_common.py:794:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"project_id = int(project_id)","category":"blocker","line_end":794,"severity":"low","line_start":794},{"id":"blocker:scripts/zentao_common.py:890:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"uid = self._extract_uid(response.text, f\"任务ID: {task_id}\")","category":"blocker","line_end":890,"severity":"low","line_start":890},{"id":"blocker:scripts/zentao_common.py:1025:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"for effort_id in effort_ids:","category":"blocker","line_end":1025,"severity":"low","line_start":1025},{"id":"blocker:scripts/zentao_common.py:1054:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"uid = self._extract_uid(response.text, f\"任务ID: {task_id}\")","category":"blocker","line_end":1054,"severity":"low","line_start":1054},{"id":"blocker:scripts/zentao_common.py:1058:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"post_data[\"uid\"] = uid","category":"blocker","line_end":1059,"severity":"low","line_start":1058},{"id":"blocker:scripts/zentao_common.py:1206:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"task_id = task.get(\"id\")","category":"blocker","line_end":1206,"severity":"low","line_start":1206},{"id":"blocker:scripts/zentao_common.py:1292:system-reconnaissance","file":"scripts/zentao_common.py","pattern":"System reconnaissance","snippet":"task_id = task.get(\"id\")","category":"blocker","line_end":1292,"severity":"low","line_start":1292},{"id":"env_access:SECURITY.md:25:dotenv-library","file":"SECURITY.md","pattern":"dotenv library","snippet":"运行时依赖均为常用开源库:`requests`、`beautifulsoup4`、`python-dotenv`、`chinese-calendar`。技能包内只有 Python 源码和 Markdo","category":"env_access","line_end":25,"severity":"low","line_start":25},{"id":"sensitive:SECURITY.md:7:environment-file-access","file":"SECURITY.md","pattern":"Environment file access","snippet":"- 唯一凭据来源:进程环境变量 `ZENTAO_BASE_URL` / `ZENTAO_ACCOUNT` / `ZENTAO_PASSWORD`,或用户通过 `--env-file` 显式指定的本地 ","category":"sensitive","line_end":7,"severity":"high","line_start":7},{"id":"sensitive:SECURITY.md:8:environment-file-access","file":"SECURITY.md","pattern":"Environment file access","snippet":"- 技能包内不含任何真实凭据,只附带 `.env.example` 模板;`.env` 与 `__pycache__/` 在打包时会被排除。","category":"sensitive","line_end":8,"severity":"high","line_start":8},{"id":"sensitive:SECURITY.md:10:environment-file-access","file":"SECURITY.md","pattern":"Environment file access","snippet":"- 脚本不会写入、复制或上传 `.env`,凭据始终留在用户本机。","category":"sensitive","line_end":10,"severity":"high","line_start":10},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get_next_workdays.py` 用于查询当前或下一段连续工作日,在规划阶段使用,一般情况下是规划本周或者下周工作日的任务。","category":"external_commands","line_end":12,"severity":"medium","line_start":12},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `get_task_types.py` 从禅道页面获取任务类型枚举","category":"external_commands","line_end":15,"severity":"medium","line_start":15},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `list_tasks.py` 查看用户当前任务列表","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `create_tasks.py` 创建任务,只能在任务表确认后使用","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `finish_tasks_by_date.py` 按日期范围批量完成任务","category":"external_commands","line_end":18,"severity":"medium","line_start":18},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `repair_task_finish_date.py` 修复任务填错的完成日期","category":"external_commands","line_end":19,"severity":"medium","line_start":19},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `close_finished_tasks.py` 关闭已完成但未关闭的任务","category":"external_commands","line_end":20,"severity":"medium","line_start":20},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 凭据(`ZENTAO_ACCOUNT` / `ZENTAO_PASSWORD`)只从进程环境变量或用户本地的 `.env` 文件读取,本技能不包含、不生成、不转发任何凭据。","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 所有网络请求统一经过地址校验,只会发往用户自己配置的 `ZENTAO_BASE_URL`,不访问任何第三方服务,无遥测。","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- 所有写操作默认预览(dry-run),必须显式加 `--execute` 并经用户确认后才会写入禅道。","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `scripts/zentao_common.py`:本技能内部实现逻辑,通常无需直接阅读","category":"external_commands","line_end":47,"severity":"medium","line_start":47},{"id":"sensitive:SKILL.md:30:environment-file-access","file":"SKILL.md","pattern":"Environment file access","snippet":"- 凭据(`ZENTAO_ACCOUNT` / `ZENTAO_PASSWORD`)只从进程环境变量或用户本地的 `.env` 文件读取,本技能不包含、不生成、不转发任何凭据。","category":"sensitive","line_end":30,"severity":"high","line_start":30},{"id":"obfuscation:references/commands.md:1:heuristic-high-file-entropy-6-72-bits-possible-b","file":"references/commands.md","pattern":"[HEURISTIC] High file entropy (6.72 bits) - possible binary/encrypted content","snippet":"File: references/commands.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/plan-task.md:1:heuristic-high-file-entropy-7-17-bits-possible-b","file":"references/plan-task.md","pattern":"[HEURISTIC] High file entropy (7.17 bits) - possible binary/encrypted content","snippet":"File: references/plan-task.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:references/repair-finish-date.md:1:heuristic-high-file-entropy-6-00-bits-possible-b","file":"references/repair-finish-date.md","pattern":"[HEURISTIC] High file entropy (6.00 bits) - possible binary/encrypted content","snippet":"File: references/repair-finish-date.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SECURITY.md:1:heuristic-high-file-entropy-7-15-bits-possible-b","file":"SECURITY.md","pattern":"[HEURISTIC] High file entropy (7.15 bits) - possible binary/encrypted content","snippet":"File: SECURITY.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-38-bits-possible-b","file":"SKILL.md","pattern":"[HEURISTIC] High file entropy (6.38 bits) - possible binary/encrypted content","snippet":"File: SKILL.md","category":"obfuscation","line_end":1,"severity":"high","line_start":1}],"finding_verdicts":[{"id":"network:.env.example:2:hardcoded-url","reason":"The value is an HTTPS placeholder for the user-configured Zentao instance, not a fixed external destination.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:.env.example:1:environment-file-access","reason":"This is a credential-free template that explicitly warns users to keep the populated .env local and out of version control.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/close-tasks.md:12:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"network:references/commands.md:8:hardcoded-url","reason":"The value is an HTTPS placeholder for the user-configured Zentao instance, not a fixed external destination.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/commands.md:20:path-traversal-sequence","reason":"The sequence is a Markdown link to the adjacent SECURITY.md document and does not drive filesystem access.","verdict":"false_positive","confidence":0.99},{"id":"filesystem:references/commands.md:28:hidden-file-access","reason":"This documents an explicit local .env path supplied or selected by the user; it does not search unrelated hidden files.","verdict":"false_positive","confidence":0.96},{"id":"env_access:references/commands.md:25:dotenv-library","reason":"The cited line only documents python-dotenv as a required dependency and performs no environment access.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:references/commands.md:5:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/commands.md:17:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/commands.md:18:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/commands.md:28:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/commands.md:30:environment-file-access","reason":"The text recommends storing a task-plan file near .env for reuse; it does not instruct reading or exposing the credential file.","verdict":"false_positive","confidence":0.91},{"id":"sensitive:references/create-tasks.md:15:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/finish-tasks.md:16:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"filesystem:references/get-task-types.md:24:hidden-file-access","reason":"This documents an explicit local .env path supplied or selected by the user; it does not search unrelated hidden files.","verdict":"false_positive","confidence":0.96},{"id":"sensitive:references/get-task-types.md:11:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/get-task-types.md:24:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/list-tasks.md:21:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/plan-task.md:3:environment-file-access","reason":"The text recommends storing a task-plan file near .env for reuse; it does not instruct reading or exposing the credential file.","verdict":"false_positive","confidence":0.91},{"id":"sensitive:references/repair-finish-date.md:15:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/repair-finish-date.md:30:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:references/repair-finish-date.md:36:environment-file-access","reason":"The cited documentation describes the optional local --env-file input and does not itself access or disclose credentials.","verdict":"false_positive","confidence":0.97},{"id":"blocker:references/repair-finish-date.md:30:system-reconnaissance","reason":"The cited text is a documented command example for a known skill script, not host or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:references/repair-finish-date.md:36:system-reconnaissance","reason":"The cited text is a documented command example for a known skill script, not host or network reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/close_finished_tasks.py:13:environment-file-access","reason":"This line only defines an optional user-controlled --env-file argument for the declared Zentao configuration flow.","verdict":"false_positive","confidence":0.97},{"id":"scripts:scripts/create_tasks.py:7:dynamic-import-expression","reason":"This is a static multiline Python import from zentao_common, with no computed module name or dynamic loading.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/create_tasks.py:21:environment-file-access","reason":"This line only defines an optional user-controlled --env-file argument for the declared Zentao configuration flow.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/finish_tasks_by_date.py:26:environment-file-access","reason":"This line only defines an optional user-controlled --env-file argument for the declared Zentao configuration flow.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/get_task_types.py:12:environment-file-access","reason":"This line only defines an optional user-controlled --env-file argument for the declared Zentao configuration flow.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/list_tasks.py:46:environment-file-access","reason":"This line only defines an optional user-controlled --env-file argument for the declared Zentao configuration flow.","verdict":"false_positive","confidence":0.97},{"id":"sensitive:scripts/repair_task_finish_date.py:16:environment-file-access","reason":"This line only defines an optional user-controlled --env-file argument for the declared Zentao configuration flow.","verdict":"false_positive","confidence":0.97},{"id":"network:scripts/zentao_common.py:17:python-http-libraries","reason":"Requests is used for the declared Zentao integration, with destinations constructed from the user-configured base URL and a shared timeout adapter.","verdict":"false_positive","confidence":0.96},{"id":"network:scripts/zentao_common.py:386:python-http-libraries","reason":"Requests is used for the declared Zentao integration, with destinations constructed from the user-configured base URL and a shared timeout adapter.","verdict":"false_positive","confidence":0.96},{"id":"network:scripts/zentao_common.py:433:python-http-libraries","reason":"Requests is used for the declared Zentao integration, with destinations constructed from the user-configured base URL and a shared timeout adapter.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/zentao_common.py:165:python-getenv-function","reason":"The code reads three fixed Zentao configuration variables for the declared login flow and does not enumerate or export the environment.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/zentao_common.py:166:python-getenv-function","reason":"The code reads three fixed Zentao configuration variables for the declared login flow and does not enumerate or export the environment.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/zentao_common.py:167:python-getenv-function","reason":"The code reads three fixed Zentao configuration variables for the declared login flow and does not enumerate or export the environment.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/zentao_common.py:165:getenv-function-call","reason":"The code reads three fixed Zentao configuration variables for the declared login flow and does not enumerate or export the environment.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/zentao_common.py:166:getenv-function-call","reason":"The code reads three fixed Zentao configuration variables for the declared login flow and does not enumerate or export the environment.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/zentao_common.py:167:getenv-function-call","reason":"The code reads three fixed Zentao configuration variables for the declared login flow and does not enumerate or export the environment.","verdict":"false_positive","confidence":0.97},{"id":"env_access:scripts/zentao_common.py:16:dotenv-library","reason":"python-dotenv loads the explicit or skill-local configuration file without overriding existing process variables; no upload or disclosure is present.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/zentao_common.py:146:dotenv-library","reason":"python-dotenv loads the explicit or skill-local configuration file without overriding existing process variables; no upload or disclosure is present.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/zentao_common.py:16:python-dotenv-loader","reason":"python-dotenv loads the explicit or skill-local configuration file without overriding existing process variables; no upload or disclosure is present.","verdict":"false_positive","confidence":0.96},{"id":"env_access:scripts/zentao_common.py:146:python-dotenv-loader","reason":"python-dotenv loads the explicit or skill-local configuration file without overriding existing process variables; no upload or disclosure is present.","verdict":"false_positive","confidence":0.96},{"id":"obfuscation:scripts/zentao_common.py:440:unicode-escape-sequence","reason":"The Unicode escape removes an optional byte-order mark before JSON parsing and does not conceal executable content.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:scripts/zentao_common.py:137:environment-file-access","reason":"The loader checks only the user-specified path or the skill-local .env for declared Zentao credentials and does not copy, log, or upload the file.","verdict":"false_positive","confidence":0.95},{"id":"sensitive:scripts/zentao_common.py:142:environment-file-access","reason":"The loader checks only the user-specified path or the skill-local .env for declared Zentao credentials and does not copy, log, or upload the file.","verdict":"false_positive","confidence":0.95},{"id":"sensitive:scripts/zentao_common.py:792:certificate-key-files","reason":"The cited statement selects a project identifier from a dictionary and does not access certificates, keys, or credential files.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:8:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:319:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:425:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:489:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:494:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:605:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:731:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:732:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:748:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:749:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:779:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:784:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:792:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:794:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:890:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:1025:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:1054:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:1058:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:1206:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:scripts/zentao_common.py:1292:system-reconnaissance","reason":"The cited code parses Zentao task, project, effort, session, or UUID values and does not inspect the host environment.","verdict":"false_positive","confidence":0.99},{"id":"env_access:SECURITY.md:25:dotenv-library","reason":"The cited line only documents python-dotenv as a required dependency and performs no environment access.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SECURITY.md:7:environment-file-access","reason":"The cited line documents local credential handling and explicitly states that credentials are not bundled, generated, forwarded, or uploaded.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SECURITY.md:8:environment-file-access","reason":"The cited line documents local credential handling and explicitly states that credentials are not bundled, generated, forwarded, or uploaded.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SECURITY.md:10:environment-file-access","reason":"The cited line documents local credential handling and explicitly states that credentials are not bundled, generated, forwarded, or uploaded.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:12:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:15:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:18:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:19:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:20:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:47:ruby-shell-backtick-execution","reason":"Backticks are Markdown formatting around script names or configuration terms; no Ruby or shell execution occurs on this line.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:SKILL.md:30:environment-file-access","reason":"The cited line documents local credential handling and explicitly states that credentials are not bundled, generated, forwarded, or uploaded.","verdict":"false_positive","confidence":0.99},{"id":"obfuscation:references/commands.md:1:heuristic-high-file-entropy-6-72-bits-possible-b","reason":"The file is readable UTF-8 Markdown with Chinese documentation and examples; inspection found no binary, encrypted, or obfuscated payload.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/plan-task.md:1:heuristic-high-file-entropy-7-17-bits-possible-b","reason":"The file is readable UTF-8 Markdown with Chinese documentation and examples; inspection found no binary, encrypted, or obfuscated payload.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:references/repair-finish-date.md:1:heuristic-high-file-entropy-6-00-bits-possible-b","reason":"The file is readable UTF-8 Markdown with Chinese documentation and examples; inspection found no binary, encrypted, or obfuscated payload.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:SECURITY.md:1:heuristic-high-file-entropy-7-15-bits-possible-b","reason":"The file is readable UTF-8 Markdown with Chinese documentation and examples; inspection found no binary, encrypted, or obfuscated payload.","verdict":"false_positive","confidence":0.98},{"id":"obfuscation:SKILL.md:1:heuristic-high-file-entropy-6-38-bits-possible-b","reason":"The file is readable UTF-8 Markdown with Chinese documentation and examples; inspection found no binary, encrypted, or obfuscated payload.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Plain HTTP Can Expose Zentao Credentials","severity":"high","locations":[{"file":"scripts/zentao_common.py","line_end":183,"line_start":181},{"file":"scripts/zentao_common.py","line_end":416,"line_start":411}],"confidence":0.99,"description":"The client accepts HTTP base URLs, then submits the Zentao account and password to the login endpoint without transport encryption.","confidence_reasoning":"The scheme check explicitly permits http://, and the login method directly posts both credential fields to that configured origin."},{"title":"Redirects Can Bypass the Configured Network Boundary","severity":"high","locations":[{"file":"scripts/zentao_common.py","line_end":416,"line_start":403}],"confidence":0.94,"description":"Requests follows redirects by default, but the client validates only the initial URL. A cross-origin redirect can leave the configured Zentao origin.","confidence_reasoning":"The initial URL receives a prefix check, while the session request does not disable redirects or validate the final response URL and redirect history."}],"subject_marketplace_commit_sha":"7b0e7cf67446844ab9bf2218247856d49e498720","subject_content_hash":"fb6b576977c6f2f6b5904894c8a626b2fc2f581ad5e0fee02d6711cbd4d80970","subject_tree_hash":"afc5d033c22f74da47585ff696d6e33d447d7d81a3b6ed1b9dede4277ef39dde","subject_plugin_path":"skills/ariesyb/zentao-task-planner","audit_payload_hash":"8b96a4f83a787e438257bf00d5cef67e","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"7b0e7cf67446844ab9bf2218247856d49e498720","contentHash":"fb6b576977c6f2f6b5904894c8a626b2fc2f581ad5e0fee02d6711cbd4d80970","treeHash":"afc5d033c22f74da47585ff696d6e33d447d7d81a3b6ed1b9dede4277ef39dde","pluginPath":"skills/ariesyb/zentao-task-planner","auditPayloadHash":"8b96a4f83a787e438257bf00d5cef67e"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/ariesyb-zentao-task-planner/audits/7/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}