技能 zentao-api
📦
zentao-api
v1.0.4 内容修订 r1 高风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问
通过 API 管理 ZenTao 项目
团队需要快速访问 ZenTao 工作项，而不必手动构建 API 请求。此技能会将自然语言请求映射到 ZenTao REST API v2.0 调用。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "zentao-api" from https://skillstore.io/skills/easysoft-zentao-api.md and its manifest at https://skillstore.io/api/skills/easysoft-zentao-api/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“zentao-api”。 Show active projects and their executions.
预期结果:
一份简洁的项目列表，包含 ID、活动执行名称、状态、负责人和后续查询建议。
正在使用“zentao-api”。 Create a critical bug for product 12.
预期结果:
一份确认摘要，显示目标产品、标题、严重程度、构建、负责人以及将提交的确切字段。
正在使用“zentao-api”。 Resolve bug 345 as fixed.
预期结果:
一条状态更新，确认已解决的缺陷、解决结果值、服务器响应摘要以及任何后续字段。
安全审计
高风险v4 • 2026/7/6 打开版本化报告
The skill is a legitimate ZenTao REST API helper, and many static hits are Markdown code spans or intended API examples. Confirmed issues are the eval-based token helper and plaintext persistent token cache in ~/.zentao-token.json. These can expose long-lived credentials and enable shell execution from malicious token values.
3
已扫描文件
776
分析行数
21
复核项
0
已忽略误报
已确认安全问题 (2)
高
Unsafe Eval-Based Credential Export
The skill tells agents to run eval "$(bash scripts/get-token.sh)", while the helper prints ZENTAO_URL, ZENTAO_TOKEN, and ZENTAO_ACCOUNT without shell escaping. A token from cache, environment, or server response can execute shell syntax when evaluated.
The documented eval command is explicit, and the helper emits raw assignment lines without shell quoting. The token value can originate from a server response or cache file.
高
Persistent Plaintext ZenTao Token Cache
The helper states ZenTao tokens are permanent and writes token, URL, and account data to ~/.zentao-token.json without setting restrictive permissions. This can expose long-lived API credentials to local users or backups.
The cache path and write operations are explicit, and the script comments say ZenTao tokens are permanent. No chmod or credential-store protection is present in the helper.
能力复核项 (21)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Shell command substitution
# 用法:eval "$(bash get-token.sh)" → 设置 ZENTAO_URL、ZENTAO_TOKEN、ZENTAO_ACCOUNT
The documented usage evals the helper output, while the helper prints unescaped URL, token, and account values. A malicious token or cache value can execute shell syntax when evaluated.
高
Node.js fs operations
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
The helper writes ZENTAO_TOKEN, URL, and account into ~/.zentao-token.json in plaintext. The script states tokens are permanent, so local disclosure is a real credential risk.
高
Node.js fs operations
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
The helper writes ZENTAO_TOKEN, URL, and account into ~/.zentao-token.json in plaintext. The script states tokens are permanent, so local disclosure is a real credential risk.
高
Synchronous file operations
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
The helper writes ZENTAO_TOKEN, URL, and account into ~/.zentao-token.json in plaintext. The script states tokens are permanent, so local disclosure is a real credential risk.
高
Synchronous file operations
fs.writeFileSync(cachePath, JSON.stringify({ token, url, account }, null, 2));
The helper writes ZENTAO_TOKEN, URL, and account into ~/.zentao-token.json in plaintext. The script states tokens are permanent, so local disclosure is a real credential risk.
高
Hidden file in home directory
# 缓存文件 ~/.zentao-token.json 保存 token、url、account,下次可免密直接使用。
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
高
Hidden file in home directory
echo " · 缓存文件 ~/.zentao-token.json(含 url、token、account 字段)" >&2
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
高
Hidden file access
# 缓存文件 ~/.zentao-token.json 保存 token、url、account,下次可免密直接使用。
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
高
Hidden file access
CACHE_FILE="${HOME}/.zentao-token.json"
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
高
Hidden file access
echo " · 缓存文件 ~/.zentao-token.json(含 url、token、account 字段)" >&2
The script deliberately uses a hidden home-directory cache for ZenTao URL, token, and account data. Storing long-lived credentials this way is a real local exposure risk.
高
Ruby/shell backtick execution
```bash
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
高
Ruby/shell backtick execution
后续所有请求 Header 携带:`token: $ZENTAO_TOKEN`
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
高
Ruby/shell backtick execution
1. 运行 `eval "$(bash scripts/get-token.sh)"` 获取凭证(自动处理缓存;仍缺失时提示用户)
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
高
Shell command substitution
eval "$(bash scripts/get-token.sh)"
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
高
Shell command substitution
1. 运行 `eval "$(bash scripts/get-token.sh)"` 获取凭证(自动处理缓存;仍缺失时提示用户)
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
高
Template literal with command substitution
```bash
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
高
Template literal with command substitution
1. 运行 `eval "$(bash scripts/get-token.sh)"` 获取凭证(自动处理缓存;仍缺失时提示用户)
SKILL.md instructs users or agents to run eval "$(bash scripts/get-token.sh)". Because the helper emits unescaped values from cache, environment, or server response, this is a real shell injection risk.
高
Hidden file in home directory
**首次登录后 `ZENTAO_URL`、`ZENTAO_TOKEN`、`ZENTAO_ACCOUNT` 写入 `~/.zentao-token.json`,后续无需重复设置**。
SKILL.md documents that ZenTao URL, token, and account are written to ~/.zentao-token.json after first login. This is persistent plaintext credential storage in a hidden home file.
高
Hidden file access
**首次登录后 `ZENTAO_URL`、`ZENTAO_TOKEN`、`ZENTAO_ACCOUNT` 写入 `~/.zentao-token.json`,后续无需重复设置**。
SKILL.md documents that ZenTao URL, token, and account are written to ~/.zentao-token.json after first login. This is persistent plaintext credential storage in a hidden home file.
中
Synchronous file operations
const d = JSON.parse(require('fs').readFileSync(process.argv[1], 'utf8'));
The helper reads credentials from ~/.zentao-token.json and feeds them into the shell setup workflow. A tampered cache can supply unsafe values to the eval-based usage pattern.
中
Ruby/shell backtick execution
所有业务 API 需在 Header 携带 `token`。运行 `scripts/get-token.sh` 自动获取:
The skill instructs agents to run a bundled shell credential helper. That helper writes a token cache and emits raw shell assignments, so this crosses a real credential boundary.
风险因素
⚙️ 外部命令 (80)
scripts/get-token.sh:3 scripts/get-token.sh:71-73 scripts/get-token.sh:75-77 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:22 SKILL.md:24 SKILL.md:26 SKILL.md:30 SKILL.md:32-35 SKILL.md:35-37 SKILL.md:37 SKILL.md:39-43 SKILL.md:43-52 SKILL.md:52-56 SKILL.md:56-57 SKILL.md:57-58 SKILL.md:58-59 SKILL.md:59-60 SKILL.md:60-61 SKILL.md:61-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-65 SKILL.md:65-66 SKILL.md:66-67 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73-74 SKILL.md:74-84 SKILL.md:84 SKILL.md:85 SKILL.md:86-87 SKILL.md:87-89 SKILL.md:89 SKILL.md:95-98 SKILL.md:98-102 SKILL.md:102-106 SKILL.md:106-110 SKILL.md:110-114 SKILL.md:114-118 SKILL.md:118-122 SKILL.md:122-126 SKILL.md:126-130 SKILL.md:130-134 SKILL.md:134-138 SKILL.md:138-142 SKILL.md:142-146 SKILL.md:146-150 SKILL.md:150-154 SKILL.md:154-158 SKILL.md:158-162 SKILL.md:162-168 SKILL.md:168 SKILL.md:169 SKILL.md:170 SKILL.md:171 SKILL.md:172 SKILL.md:173 SKILL.md:174 SKILL.md:175 SKILL.md:176 SKILL.md:177 SKILL.md:178 SKILL.md:179 SKILL.md:180 SKILL.md:181 SKILL.md:215-216 SKILL.md:216 SKILL.md:220-221 SKILL.md:221 SKILL.md:33 SKILL.md:43 SKILL.md:32-35 SKILL.md:43
📁 文件系统访问 (15)
scripts/get-token.sh:57 scripts/get-token.sh:98 scripts/get-token.sh:30 scripts/get-token.sh:57 scripts/get-token.sh:98 scripts/get-token.sh:5 scripts/get-token.sh:65 scripts/get-token.sh:5 scripts/get-token.sh:10 scripts/get-token.sh:65 scripts/get-token.sh:33 SKILL.md:24 SKILL.md:220 SKILL.md:24 SKILL.md:220
🌐 网络访问 (4)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/easysoft-zentao-api/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/easysoft-zentao-api?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/easysoft-zentao-api?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/easysoft-zentao-api/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/easysoft-zentao-api.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
easysoft. (2026). zentao-api security audit report (audit version 4) [Author version 1.0.4]. Skillstore. https://skillstore.io/skills/easysoft-zentao-api/audits/4BibTeX 引用
@techreport{easysoft-easysoft-zentao-api-2026,
author = {easysoft},
title = {zentao-api security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/easysoft-zentao-api/audits/4},
note = {Author version 1.0.4}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "zentao-api security audit report (audit version 4)"
version: "1.0.4"
type: report
authors:
- name: "easysoft"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/easysoft-zentao-api/audits/4"
identifiers:
- type: other
value: "skillstore:easysoft-zentao-api:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 45
架构
100
可维护性
85
内容
68
社区
100
规范符合性
你能构建什么
审查交付状态
无需手动编写 API URL，即可审查活动项目、执行和受阻工作。
分诊缺陷和测试工作
使用一致的 ZenTao 字段创建、过滤、解决或关闭缺陷和测试记录。
维护 Sprint 任务
在保留必需工作流字段的同时，更新任务、需求、构建和发布。
试试这些提示
列出活动项目
显示活动 ZenTao 项目并列出其活动执行。包括名称、ID、负责人和当前状态。
查找产品缺陷
查找 product 12 的未关闭缺陷。按最新优先排序，并总结严重程度、负责人和标题。
创建已确认缺陷
为 product 12 准备一个新缺陷，包含标题、严重程度、构建和指定负责人。创建前请让我确认。
协调发布更新
审查 project 8 的缺陷、任务和构建。提出发布操作，然后在执行前确认每个 ZenTao 写入操作。
最佳实践
- 使用前在环境变量中设置 ZENTAO_URL 和 ZENTAO_TOKEN。
- 确认所有创建、更新、删除和状态变更操作。
- 发送写入请求前，先在 API 参考中审查必填字段。
避免
- 不要将永久 token 粘贴到聊天记录中。
- 不要在未确认目标 ID 的情况下运行破坏性更改。
- 创建 Story、Epic 或 Requirement 记录时，不要依赖默认 grade 值。
常见问题
此技能连接到什么？
它会连接到你提供的服务器上的 ZenTao REST API v2.0。
它需要凭据吗？
是的。它需要 ZenTao URL，以及 token 或账号凭据。
它可以更改 ZenTao 记录吗？
是的。在你批准这些操作后，它可以创建、更新、删除和流转记录。
涵盖哪些模块？
它涵盖项目、产品、执行、需求、缺陷、任务、测试、发布、用户、文件、反馈和工单。
它支持 Claude、Codex 和 Claude Code 吗？
是的。报告声明支持 Claude、Codex 和 Claude Code。
身份验证如何工作？
它使用环境变量或辅助脚本来获取 ZenTao URL、token 和账号。
开发者详情
作者
easysoft许可证
MIT
作者版本
v1.0.4
Skillstore 修订
r1
引用
72d5025b022c77f7a51bdf5c1637c689c80e89d1
维护新鲜度
2026/7/18
使用量
3 次下载 · 89 次浏览
文件结构