Zentao API Skills（禅道 API 技能）

• Analyzed: May 11, 2026, 7:26 AM
• Findings: 1
• Version: 1.0.4
• Hash: 8b36cd40bea14ad78c77b9309748afe24cb48518e2b7f629c9057ca0cffb4157
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive integration for the ZenTao API but contains a significant shell injection vulnerability in its authentication flow. The file 'scripts/get-token.sh' is designed to be executed via 'eval' by the AI agent (as instructed in 'SKILL.md'), but it outputs user-controlled variables (ZENTAO_URL, ZENTAO_TOKEN, ZENTAO_ACCOUNT) without sanitization. A maliciously crafted ZENTAO_URL could lead to arbitrary command execution on the host system when the agent evaluates the script's output. Additionally, the skill stores sensitive credentials in plaintext within '~/.zentao-token.json'. While these appear to be unintentional security flaws in a legitimate tool from the official ZenTao ecosystem (easysoft/chandao.com), they present a high risk of exploitation.