Security audit

禅道MCP agent pro

Security checks for vulnerabilities and agentic risk

Overview

This ZenTao assistant is mostly purpose-aligned, but it can change live project records and uses risky installation and credential patterns that deserve manual review before use.

Install only after reviewing the npm package source/version and pinning a trusted release. Use a least-privileged ZenTao account, avoid putting passwords on the command line, and require explicit confirmation before any create, update, reassignment, effort logging, or automatic iteration creation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:96
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:106
Finding: ZenTao Password Exposed Through a Command-Line Argument
Content: View full analysis
" --pwd "<密码>" ``` ### Technical Analysis The documented authentication command accepts the ZenTao password through the `--pwd` command-line option. Secrets supplied this way can be exposed through several local channels: - Interactive shell history files. - Terminal session recording and command auditing. - Process listings or process-inspection interfaces while the command is running. - Diagnostic output, support bundles, or automation logs that capture command lines. - CI/CD job definitions and execution logs if the example is adapted for automation. Quoting the password does not prevent these disclosures; quoting only affects shell parsing. The password still forms part of the process argument vector. ### Attack Path 1. A user follows the documented command and replaces the password placeholder with a real ZenTao password. 2. The shell records the command in its history, or the operating system exposes the process argument vector while login is running. 3. Another local user, administrator, monitoring agent, terminal recorder, or later reader of the history file retrieves the command. 4. The attacker extracts the ZenTao account name, server address, and password. 5. The attacker authenticates to ZenTao using the exposed credentials. 6. The attacker reads or modifies all ZenTao information permitted to that account. ### Impact Assessment The direct impact is disclosure of the user's ZenTao password. The resulting privileges are limited by the compromised ZenTao account but may include: - Reading cross-project task, story, bug, and personnel workload information. - Creating tasks or project iterations. - Reassigning work items. - Updating task, story, and bug states. - Sub ...[truncated 214 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:41
Finding: Automatic Iteration Creation Exceeds the Requested Task Mutation
Content: View full analysis
`getActiveExecutions` -> (若无当期迭代则调用 `createExecution`) -> 最后发起 `createTask`。 - **参数指南**：务必先明确当前的迭代/执行 `execId`。如不确定，先查询项目列表及其下挂载的近期执行。如有必要跨月，可智能创建一个当月的新冲刺。派单时，可以直接传入真实的中文 `name`、`assignee` 和工时 `estimate`（默认2小时）。底层已内置自动修补禅道必填项和账号映射转换。若是“从需求拆分任务”，可直接传 `storyId + projectId`；CLI 会优先复用当月执行，若不存在则复制上个执行配置后自动创建。 ``` ```bash zentao-cli execution create --projectId 577 --name "2026年3月常规迭代" zentao-cli execution create --projectId 577 --name "2026年3月常规迭代" --begin "2026-03-17" --end "2026-03-24" zentao-cli execution create --projectId 577 --name "2026年3月常规迭代" --days 6 ``` ### Technical Analysis The task-dispatch workflow instructs the Agent to call `createExecution` when no current iteration exists. It also describes copying configuration from a previous execution and automatically creating a replacement when a task is split from a story. Creating a task and creating a project iteration are materially different operations. An iteration modifies project planning structure and may affect dates, memberships, reporting, capacity, and downstream automation. A user asking to assign or create a task has not necessarily approved creation of a new iteration. The workflow therefore violates least-privilege principles at the action level: it expands a narrowly requested task mutation into a broader project-management mutation without requiring explicit confirmation or a separate authorization check. ### Attack Path 1. A user asks the Agent to create or assign a task. 2. The Agent queries projects and active executions as directed. 3. No suitable current iteration is found. 4. Instead of stopping and requesting approval, the Skill directs the Agent to create an iteration or copy a previous iteration's configuratio ...[truncated 1083 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill encourages conversational use of task creation, reassignment, status transitions, and effort logging without prominently warning that these are write operations affecting live ZenTao records. In an LLM-agent context, that omission is especially risky because natural-language triggers can cause the model to execute impactful actions that the user may perceive as informational rather than mutating.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The security section reassures users that the extension will not perform unauthorized modifications, but the rest of the document explicitly advertises capabilities that create iterations/tasks and change status, assignees, and effort records. This mismatch can mislead operators and downstream agents into underestimating the risk of invoking the tool, increasing the chance of unintended destructive or integrity-impacting actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs users to invoke an unpinned package via npx skills add @chenish/zentao-mcp-agent, which allows whatever version is current at execution time to be fetched and run. In a privileged enterprise workflow tool that can create tasks, reassign work, and update records, a compromised or maliciously updated package could immediately gain broad access and perform unauthorized actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The login example passes the account password directly on the command line, which can expose credentials through shell history, process listings, audit logs, terminal recording, or CI logs. Because the skill grants access to a system that can view and modify project records across users and teams, credential compromise could lead to broad confidentiality and integrity impact.
Content: No source excerpt is available for this finding.