ClawHub
Back to skill

Security audit

zentao

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward ZenTao CLI helper, but users should treat its install and password login steps with care.

Install only if you trust the @leeguoo/zentao-mcp npm package and your ZenTao account permissions. Prefer a pinned reviewed version if available, avoid placing real passwords directly in shell commands or shared logs, and verify that the saved config file is owner-readable only or delete/rotate credentials when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned Global Installation of Third-Party Packages

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-32
Vulnerability Type: Supply-chain exposure through mutable, globally installed dependencies
Risk Level: Medium

Vulnerable Code

bash
pnpm i -g @leeguoo/zentao-mcp

If pnpm is not installed:

bash
npm i -g pnpm
pnpm i -g @leeguoo/zentao-mcp

Technical Analysis

The installation instructions globally install pnpm and @leeguoo/zentao-mcp without pinning either package to an audited version. No lockfile, package integrity hash, or trusted-registry constraint is provided.

Consequently, the effective code installed by these commands can change after this skill has been reviewed. Package installation may also execute lifecycle scripts with the privileges of the user performing the installation. Global installation increases the affected scope because executables and package files are placed in shared user-level or system-level locations rather than an isolated project environment.

This finding does not establish that the referenced packages are malicious. It establishes that the documented installation process does not ensure that users receive the same package contents that were reviewed.

Attack Path

  1. An attacker compromises a referenced package, its publisher account, or the package registry delivery path.
  2. The attacker publishes a malicious release under the existing package name.
  3. A user follows the skill instructions and installs the unversioned package.
  4. The package manager resolves the mutable latest version.
  5. Malicious package code or an installation lifecycle script executes with the installing user's privileges.
  6. The installed global executable can subsequently affect ZenTao operations or other activity performed by that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running the installation. Depending on those pri ...[truncated 297 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every package to a specifically reviewed version, for example @leeguoo/zentao-mcp@X.Y.Z.
  • Pin the package-manager version rather than installing the mutable latest release.
  • Maintain and verify a lockfile and registry-provided integrity hashes where applicable.
  • Use an explicitly trusted package registry and protect configuration against dependency-confusion sources.
  • Prefer a project-local, containerized, or otherwise isolated installation over global installation.
  • Review package lifecycle scripts and package provenance before recommending a release.
  • Document a controlled upgrade process requiring security review before changing pinned versions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:40
Finding

ZenTao Password Supplied Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-43
Vulnerability Type: Credential exposure through process arguments and command history
Risk Level: Medium

Vulnerable Code

bash
zentao login \
  --zentao-url="https://zentao.example.com/zentao" \
  --zentao-account="leo" \
  --zentao-password="***"

Technical Analysis

The documented workflow instructs users to place a ZenTao password directly in a command-line argument. Although the example uses a masked placeholder, users must replace it with a real password for the shown command to work.

Command-line secrets can be retained in shell history, captured by terminal session recording or automation logs, and exposed through process inspection facilities while the command is running. The exact process visibility depends on operating-system controls and local permissions, but command history may remain readable long after execution.

Attack Path

  1. A user replaces *** with a valid ZenTao password and executes the documented command.
  2. The shell records the command in its history, or an execution environment records it in terminal, CI, support, or audit logs.
  3. Alternatively, a local process inspector reads the argument while zentao login is running where operating-system permissions allow it.
  4. Another local user, compromised process, administrator, or log reader retrieves the password.
  5. The attacker authenticates to the configured ZenTao instance using the exposed account and password.

Impact Assessment

Exploitation could compromise the specified ZenTao account. The attacker could access products, bug details, and other records permitted to that account and could perform any modification supported by its assigned ZenTao privileges. This pattern does not itself grant system-level or ZenTao administrative access unless the exposed account already possesses those privileges.

Remediation
View remediation

Remediation Suggestions

  • Replace the password argument with a non-echoing interactive TTY prompt.
  • If noninteractive authentication is required, support a protected secret file descriptor, operating-system credential store, or narrowly scoped environment integration that avoids logging.
  • Prefer revocable, short-lived API tokens over reusable account passwords where ZenTao supports them.
  • Explicitly warn users not to put passwords in shell commands, scripts, CI configuration, or logs.
  • Ensure authentication errors and debug output never reproduce supplied credentials.
  • Advise affected users to clear exposed history and logs and rotate any password previously supplied through the documented argument.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:46
Finding

Credential Configuration File Lacks Documented Storage Protections

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-48
Vulnerability Type: Insufficiently specified protection for persisted authentication material
Risk Level: Low

Vulnerable Code

text
2) This writes credentials to:

- `~/.config/zentao/config.toml` (or `$XDG_CONFIG_HOME/zentao/config.toml`)

Technical Analysis

The skill states that credentials are written to a configuration file but does not specify whether the stored value is a password or token, whether it is encrypted, or whether restrictive filesystem permissions are enforced. The referenced package implementation was not included in the audited project, so plaintext storage or insecure file permissions cannot be confirmed from the available artifact.

The security issue in the reviewed documentation is the absence of required storage protections. If the implementation creates the file with permissions broader than owner-only access or stores a reusable password without protection, another local process or user could recover the authentication material.

Attack Path

This attack path applies if the external CLI stores reusable credentials without adequate access controls:

  1. The user executes zentao login.
  2. Authentication material is written to ~/.config/zentao/config.toml or the path selected through XDG_CONFIG_HOME.
  3. The file is created with permissions that allow an unauthorized local principal or compromised process to read it.
  4. The attacker extracts the stored password or token.
  5. The attacker reuses the material to access the configured ZenTao instance until it is revoked or expires.

Impact Assessment

The potential impact is compromise of the stored ZenTao identity and access to all ZenTao resources authorized for that account. Scope is limited by the account's permissions and by whether the stored credential is reusable. The reviewed material does not prove plaintext storage, weak permissions, or a ...[truncated 99 chars]

Remediation
View remediation

Remediation Suggestions

  • Store authentication material in the operating system's credential manager or keychain rather than a general TOML file.
  • Prefer short-lived, revocable, least-privilege tokens instead of reusable account passwords.
  • If a file must be used, create it atomically with owner-only permissions such as mode 0600.
  • Validate that the configuration directory is owned by the current user and is not a symbolic-link redirection target.
  • Document precisely what credential type is persisted, how it is protected, its lifetime, and how users can revoke or delete it.
  • Add automated tests verifying restrictive permissions and preventing credentials from appearing in logs or error messages.
  • Review the external CLI implementation before asserting that credential storage is secure.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.