禅道自动报告

• Analyzed: Apr 1, 2026, 2:06 PM
• Findings: 1
• Version: 1.0.2
• Hash: b59caa1f5b65fe5d6049546d2b7e0c266fdeada01f49c7196521e6371a1b22d5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill automates Zentao work reporting but contains several security vulnerabilities. Specifically, scripts/match-tasks.sh and scripts/report.sh are vulnerable to code injection because they embed unsanitized shell variables (like $USER_DESC) directly into Python one-liners executed via 'python3 -c'. Additionally, the skill stores Zentao credentials in plaintext in $HOME/.config/zentao/.env and session cookies in /tmp/cookies.txt, which are insecure practices. While these appear to be unintentional flaws rather than intentional malware, they represent significant security risks.