Skills zentao-api
📦
zentao-api
v1.0.4 Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🌐 Network access
Manage ZenTao Projects Through the API
Teams need fast access to ZenTao work items without manually building API requests. This skill maps natural language requests to ZenTao REST API v2.0 calls.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "zentao-api" from https://skillstore.io/skills/easysoft-zentao-api.md and its manifest at https://skillstore.io/api/skills/easysoft-zentao-api/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "zentao-api". Show active projects and their executions.
Expected outcome:
A concise project list with IDs, active execution names, status, owners, and next lookup suggestions.
Using "zentao-api". Create a critical bug for product 12.
Expected outcome:
A confirmation summary showing target product, title, severity, build, assignee, and the exact fields that will be submitted.
Using "zentao-api". Resolve bug 345 as fixed.
Expected outcome:
A status update that confirms the resolved bug, resolution value, server response summary, and any follow-up fields.
Security Audit
High Riskv4 • 7/6/2026 Open versioned report
The skill is a legitimate ZenTao REST API helper, and many static hits are Markdown code spans or intended API examples. Confirmed issues are the eval-based token helper and plaintext persistent token cache in ~/.zentao-token.json. These can expose long-lived credentials and enable shell execution from malicious token values.
3
Files scanned
776
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Unsafe Eval-Based Credential Export
The skill tells agents to run eval "$(bash scripts/get-token.sh)", while the helper prints ZENTAO_URL, ZENTAO_TOKEN, and ZENTAO_ACCOUNT without shell escaping. A token from cache, environment, or server response can execute shell syntax when evaluated.
The documented eval command is explicit, and the helper emits raw assignment lines without shell quoting. The token value can originate from a server response or cache file.
High
Persistent Plaintext ZenTao Token Cache
The helper states ZenTao tokens are permanent and writes token, URL, and account data to ~/.zentao-token.json without setting restrictive permissions. This can expose long-lived API credentials to local users or backups.
The cache path and write operations are explicit, and the script comments say ZenTao tokens are permanent. No chmod or credential-store protection is present in the helper.
Capability review items (21)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
# 用法:eval "$(bash get-token.sh)" → 设置 ZENTAO_URL、ZENTAO_TOKEN、ZENTAO_ACCOUNT
The documented usage evals the helper output, while the helper prints unescaped URL, token, and account values. A malicious token or cache value can execute shell syntax when evaluated.
High
Node.js fs operations
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
The helper writes ZENTAO_TOKEN, URL, and account into ~/.zentao-token.json in plaintext. The script states tokens are permanent, so local disclosure is a real credential risk.
High
Node.js fs operations
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
The helper writes ZENTAO_TOKEN, URL, and account into ~/.zentao-token.json in plaintext. The script states tokens are permanent, so local disclosure is a real credential risk.
High
Synchronous file operations
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
The helper writes ZENTAO_TOKEN, URL, and account into ~/.zentao-token.json in plaintext. The script states tokens are permanent, so local disclosure is a real credential risk.
High
Synchronous file operations
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
The helper writes ZENTAO_TOKEN, URL, and account into ~/.zentao-token.json in plaintext. The script states tokens are permanent, so local disclosure is a real credential risk.
High
Hidden file in home directory
# 缓存文件 ~/.zentao-token.json 保存 token、url、account,下次可免密直接使用。
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
High
Hidden file in home directory
echo " · 缓存文件 ~/.zentao-token.json(含 url、token、account 字段)" >&2
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
High
Hidden file access
# 缓存文件 ~/.zentao-token.json 保存 token、url、account,下次可免密直接使用。
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
High
Hidden file access
CACHE_FILE="${HOME}/.zentao-token.json"
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
High
Hidden file access
echo " · 缓存文件 ~/.zentao-token.json(含 url、token、account 字段)" >&2
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
High
Ruby/shell backtick execution
```bash
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
High
Ruby/shell backtick execution
后续所有请求 Header 携带:`token: $ZENTAO_TOKEN`
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
High
Ruby/shell backtick execution
1. 运行 `eval "$(bash scripts/get-token.sh)"` 获取凭证(自动处理缓存;仍缺失时提示用户)
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
High
Shell command substitution
eval "$(bash scripts/get-token.sh)"
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
High
Shell command substitution
1. 运行 `eval "$(bash scripts/get-token.sh)"` 获取凭证(自动处理缓存;仍缺失时提示用户)
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
High
Template literal with command substitution
```bash
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
High
Template literal with command substitution
1. 运行 `eval "$(bash scripts/get-token.sh)"` 获取凭证(自动处理缓存;仍缺失时提示用户)
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
High
Hidden file in home directory
**首次登录后 `ZENTAO_URL`、`ZENTAO_TOKEN`、`ZENTAO_ACCOUNT` 写入 `~/.zentao-token.json`,后续无需重复设置**。
SKILL.md documents that ZenTao URL, token, and account are written to ~/.zentao-token.json after first login. This is persistent plaintext credential storage in a hidden home file.
High
Hidden file access
**首次登录后 `ZENTAO_URL`、`ZENTAO_TOKEN`、`ZENTAO_ACCOUNT` 写入 `~/.zentao-token.json`,后续无需重复设置**。
SKILL.md documents that ZenTao URL, token, and account are written to ~/.zentao-token.json after first login. This is persistent plaintext credential storage in a hidden home file.
Medium
Synchronous file operations
const d = JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8'));
The helper reads credentials from ~/.zentao-token.json and feeds them into the shell setup workflow. A tampered cache can supply unsafe values to the eval-based usage pattern.
Medium
Ruby/shell backtick execution
所有业务 API 需在 Header 携带 `token`。运行 `scripts/get-token.sh` 自动获取:
The skill instructs agents to run a bundled shell credential helper. That helper writes a token cache and emits raw shell assignments, so this crosses a real credential boundary.
Risk Factors
⚙️ External commands (80)
scripts/get-token.sh:3 scripts/get-token.sh:71-73 scripts/get-token.sh:75-77 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:22 SKILL.md:24 SKILL.md:26 SKILL.md:30 SKILL.md:32-35 SKILL.md:35-37 SKILL.md:37 SKILL.md:39-43 SKILL.md:43-52 SKILL.md:52-56 SKILL.md:56-57 SKILL.md:57-58 SKILL.md:58-59 SKILL.md:59-60 SKILL.md:60-61 SKILL.md:61-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73-74 SKILL.md:74-84 SKILL.md:84 SKILL.md:85 SKILL.md:86-87 SKILL.md:87-89 SKILL.md:89 SKILL.md:95-98 SKILL.md:98-102 SKILL.md:102-106 SKILL.md:106-110 SKILL.md:110-114 SKILL.md:114-118 SKILL.md:118-122 SKILL.md:122-126 SKILL.md:126-130 SKILL.md:130-134 SKILL.md:134-138 SKILL.md:138-142 SKILL.md:142-146 SKILL.md:146-150 SKILL.md:150-154 SKILL.md:154-158 SKILL.md:158-162 SKILL.md:162-168 SKILL.md:168 SKILL.md:169 SKILL.md:170 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:174 SKILL.md:175 SKILL.md:176 SKILL.md:177 SKILL.md:178 SKILL.md:179 SKILL.md:180 SKILL.md:181 SKILL.md:215-216 SKILL.md:216 SKILL.md:220-221 SKILL.md:221 SKILL.md:33 SKILL.md:43 SKILL.md:32-35 SKILL.md:43
📁 Filesystem access (15)
scripts/get-token.sh:57 scripts/get-token.sh:98 scripts/get-token.sh:30 scripts/get-token.sh:57 scripts/get-token.sh:98 scripts/get-token.sh:5 scripts/get-token.sh:65 scripts/get-token.sh:5 scripts/get-token.sh:10 scripts/get-token.sh:65 scripts/get-token.sh:33 SKILL.md:24 SKILL.md:220 SKILL.md:24 SKILL.md:220
🌐 Network access (4)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/easysoft-zentao-api/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/easysoft-zentao-api?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/easysoft-zentao-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/easysoft-zentao-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/easysoft-zentao-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
easysoft. (2026). zentao-api security audit report (audit version 4) [Author version 1.0.4]. Skillstore. https://skillstore.io/skills/easysoft-zentao-api/audits/4BibTeX citation
@techreport{easysoft-easysoft-zentao-api-2026,
author = {easysoft},
title = {zentao-api security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/easysoft-zentao-api/audits/4},
note = {Author version 1.0.4}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "zentao-api security audit report (audit version 4)"
version: "1.0.4"
type: report
authors:
- name: "easysoft"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/easysoft-zentao-api/audits/4"
identifiers:
- type: other
value: "skillstore:easysoft-zentao-api:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
100
Maintainability
85
Content
68
Community
100
Spec Compliance
What You Can Build
Review Delivery Status
Review active projects, executions, and blocked work without manually composing API URLs.
Triage Bugs and Test Work
Create, filter, resolve, or close bugs and test records using consistent ZenTao fields.
Maintain Sprint Tasks
Update tasks, requirements, builds, and releases while preserving required workflow fields.
Try These Prompts
List Active Projects
Show active ZenTao projects and list their active executions. Include names, IDs, owners, and current status.
Find Product Bugs
Find open bugs for product 12. Sort newest first and summarize severity, assignee, and title.
Create a Confirmed Bug
Prepare a new bug for product 12 with title, severity, build, and assigned owner. Ask me to confirm before creating it.
Coordinate Release Updates
Review project 8 bugs, tasks, and builds. Propose release actions, then confirm each ZenTao write operation before execution.
Best Practices
- Set ZENTAO_URL and ZENTAO_TOKEN in environment variables before use.
- Confirm all create, update, delete, and status-change operations.
- Review required fields in the API reference before sending write requests.
Avoid
- Do not paste permanent tokens into chat transcripts.
- Do not run destructive changes without confirming target IDs.
- Do not rely on default grade values when creating Story, Epic, or Requirement records.
Frequently Asked Questions
What does this skill connect to?
It connects to ZenTao REST API v2.0 on a server you provide.
Does it need credentials?
Yes. It needs a ZenTao URL and either a token or account credentials.
Can it change ZenTao records?
Yes. It can create, update, delete, and transition records when you approve those actions.
Which modules are covered?
It covers projects, products, executions, requirements, bugs, tasks, tests, releases, users, files, feedback, and tickets.
Does it support Claude, Codex, and Claude Code?
Yes. The report declares support for Claude, Codex, and Claude Code.
How does authentication work?
It uses environment variables or the helper script to obtain the ZenTao URL, token, and account.
Developer Details
Author
easysoftLicense
MIT
Author version
v1.0.4
Skillstore revision
r1
Ref
72d5025b022c77f7a51bdf5c1637c689c80e89d1
Maintenance freshness
7/18/2026
Usage
3 downloads · 89 views
File structure