禅道MCP agent pro

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:32 PM UTC
• Version: 1.1.0

Overview

This ZenTao assistant is mostly purpose-aligned, but it can change live project records and uses risky installation and credential patterns that deserve manual review before use.

Install only after reviewing the npm package source/version and pinning a trusted release. Use a least-privileged ZenTao account, avoid putting passwords on the command line, and require explicit confirmation before any create, update, reassignment, effort logging, or automatic iteration creation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:96
• Finding: Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:4`, `SKILL.md:96-103` **Vulnerability Type**: Unpinned executable dependency and unsafe supply-chain trust **Risk Level**: High ### Evidence ```yaml metadata: {"openclaw":{"emoji":"🚀","install":[{"id":"node","kind":"node","package":"@chenish/zentao-mcp-agent","bins":["zentao-mcp","zentao-cli"],"label":"Install ZenTao AI Assistant"}]}} ``` ```bash # Global CLI installation npm install -g @chenish/zentao-mcp-agent # Install through npx npx skills add @chenish/zentao-mcp-agent ``` ### Technical Analysis The Skill instructs users and the hosting platform to install `@chenish/zentao-mcp-agent` without an exact version, lockfile, or integrity hash. Package resolution can therefore select whichever release is currently associated with the applicable npm distribution tag. The global installation method makes package-provided executables available system-wide for the current environment. Depending on npm configuration, package lifecycle scripts may also run during installation. The `npx` workflow similarly retrieves executable third-party content at installation time. The repository contains only `SKILL.md`; it does not contain the installed package's source code or a checksum that would allow the downloaded artifact to be verified against reviewed code. Consequently, the effective executable implementation can change after this Skill has been audited. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release workflow, or another part of the package supply chain. 2. The attacker publishes a malicious version under `@chenish/zentao-mcp-agent` or changes the version resolved by the default distribution tag. 3. A user or automation follows the Skill and runs the unpinned `npm install -g` or `npx skills add` command. 4. npm retrieves the attacker-controlled release. 5. Malicious lifecycle or runtime code executes with the privileges of the installing user. 6. ...[truncated 916 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to an audited exact version, for example: ```bash npm install --global @chenish/zentao-mcp-agent@X.Y.Z ``` 2. Publish and verify the expected npm integrity digest for the selected package artifact. 3. Use a lockfile where the installation mechanism supports one, and commit it to the reviewed project. 4. Avoid global installation where possible. Install into a dedicated, least-privileged project or isolated runtime. 5. Disable npm lifecycle scripts during installation when they are not required: ```bash npm install --ignore-scripts ``` 6. If lifecycle scripts are required, audit them and document why each script is necessary. 7. Verify that the npm package is produced reproducibly from the referenced source repository and signed through a trusted release process. 8. Run the MCP service with a dedicated operating-system identity and only the filesystem and network permissions required for ZenTao access. 9. Establish a controlled update process so new versions are reviewed before the pinned version is changed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:106
• Finding: ZenTao Password Exposed Through a Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:106-108` **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Evidence ```bash zentao-cli login --url "https://xxxxx.com/zentao" --account "<账号>" --pwd "<密码>" ``` ### Technical Analysis The documented authentication command accepts the ZenTao password through the `--pwd` command-line option. Secrets supplied this way can be exposed through several local channels: - Interactive shell history files. - Terminal session recording and command auditing. - Process listings or process-inspection interfaces while the command is running. - Diagnostic output, support bundles, or automation logs that capture command lines. - CI/CD job definitions and execution logs if the example is adapted for automation. Quoting the password does not prevent these disclosures; quoting only affects shell parsing. The password still forms part of the process argument vector. ### Attack Path 1. A user follows the documented command and replaces the password placeholder with a real ZenTao password. 2. The shell records the command in its history, or the operating system exposes the process argument vector while login is running. 3. Another local user, administrator, monitoring agent, terminal recorder, or later reader of the history file retrieves the command. 4. The attacker extracts the ZenTao account name, server address, and password. 5. The attacker authenticates to ZenTao using the exposed credentials. 6. The attacker reads or modifies all ZenTao information permitted to that account. ### Impact Assessment The direct impact is disclosure of the user's ZenTao password. The resulting privileges are limited by the compromised ZenTao account but may include: - Reading cross-project task, story, bug, and personnel workload information. - Creating tasks or project iterations. - Reassigning work items. - Updating task, story, and bug states. - Sub ...[truncated 214 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--pwd` from the recommended command-line workflow. 2. Have `zentao-cli login` request the password through an interactive, non-echoing terminal prompt. 3. Store resulting tokens in an operating-system credential manager or encrypted secret store rather than retaining the plaintext password. 4. For noninteractive use, support reading the secret from a protected file descriptor or standard input. 5. If environment-variable input must be supported, clearly document that environment variables can also be exposed and must not be logged or inherited by unrelated child processes. 6. Ensure authentication failures and debug logs never print passwords, authorization headers, session cookies, or tokens. 7. Apply restrictive permissions to any local authentication cache and provide a logout command that reliably deletes cached credentials. 8. Advise users who already followed the documented pattern to remove the affected shell-history entry and rotate the exposed password. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:41
• Finding: Automatic Iteration Creation Exceeds the Requested Task Mutation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:41-42`, `SKILL.md:174-181` **Vulnerability Type**: Unconfirmed expansion from task creation to project-structure modification **Risk Level**: Medium ### Evidence ```text - **调用动作**：组合调用 `getProjects` -> `getActiveExecutions` -> (若无当期迭代则调用 `createExecution`) -> 最后发起 `createTask`。 - **参数指南**：务必先明确当前的迭代/执行 `execId`。如不确定，先查询项目列表及其下挂载的近期执行。如有必要跨月，可智能创建一个当月的新冲刺。派单时，可以直接传入真实的中文 `name`、`assignee` 和工时 `estimate`（默认2小时）。底层已内置自动修补禅道必填项和账号映射转换。若是“从需求拆分任务”，可直接传 `storyId + projectId`；CLI 会优先复用当月执行，若不存在则复制上个执行配置后自动创建。 ``` ```bash zentao-cli execution create --projectId 577 --name "2026年3月常规迭代" zentao-cli execution create --projectId 577 --name "2026年3月常规迭代" --begin "2026-03-17" --end "2026-03-24" zentao-cli execution create --projectId 577 --name "2026年3月常规迭代" --days 6 ``` ### Technical Analysis The task-dispatch workflow instructs the Agent to call `createExecution` when no current iteration exists. It also describes copying configuration from a previous execution and automatically creating a replacement when a task is split from a story. Creating a task and creating a project iteration are materially different operations. An iteration modifies project planning structure and may affect dates, memberships, reporting, capacity, and downstream automation. A user asking to assign or create a task has not necessarily approved creation of a new iteration. The workflow therefore violates least-privilege principles at the action level: it expands a narrowly requested task mutation into a broader project-management mutation without requiring explicit confirmation or a separate authorization check. ### Attack Path 1. A user asks the Agent to create or assign a task. 2. The Agent queries projects and active executions as directed. 3. No suitable current iteration is found. 4. Instead of stopping and requesting approval, the Skill directs the Agent to create an iteration or copy a previous iteration's configuratio ...[truncated 1083 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat `createExecution` as a separate privileged mutation and require explicit user confirmation before invoking it. 2. Present a complete proposed change before confirmation, including: - Project identifier and name. - Execution name. - Start and end dates. - Working-day count. - Template execution, if configuration will be copied. - The task that will be created afterward. 3. Verify that the authenticated user has project-management authority rather than relying only on whether the API accepts the request. 4. When no active execution exists, default to stopping and asking the user to select an existing execution or approve a new one. 5. Add duplicate detection based on project, date range, and normalized execution name. 6. Do not copy configuration from an earlier execution without showing which fields will be inherited. 7. Support a dry-run or preview mode that performs reads but no mutations. 8. Record an audit trail linking the explicit confirmation to the resulting execution and task identifiers. 9. Apply separate confirmation to cross-month creation because it can alter a different planning period from the user's original context. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill encourages conversational use of task creation, reassignment, status transitions, and effort logging without prominently warning that these are write operations affecting live ZenTao records. In an LLM-agent context, that omission is especially risky because natural-language triggers can cause the model to execute impactful actions that the user may perceive as informational rather than mutating.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The security section reassures users that the extension will not perform unauthorized modifications, but the rest of the document explicitly advertises capabilities that create iterations/tasks and change status, assignees, and effort records. This mismatch can mislead operators and downstream agents into underestimating the risk of invoking the tool, increasing the chance of unintended destructive or integrity-impacting actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs users to invoke an unpinned package via `npx skills add @chenish/zentao-mcp-agent`, which allows whatever version is current at execution time to be fetched and run. In a privileged enterprise workflow tool that can create tasks, reassign work, and update records, a compromised or maliciously updated package could immediately gain broad access and perform unauthorized actions.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The login example passes the account password directly on the command line, which can expose credentials through shell history, process listings, audit logs, terminal recording, or CI logs. Because the skill grants access to a system that can view and modify project records across users and teams, credential compromise could lead to broad confidentiality and integrity impact.

Static analysis

No suspicious patterns detected.