ClawHub
Back to skill

Security audit

zentao-bug-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent bug-analysis purpose, but it asks for sensitive credentials and broad local/browser authority with several under-scoped unsafe behaviors.

Review carefully before installing. Use only with a low-privilege ZenTao account, HTTPS, explicit review before posting comments, isolated disposable worktrees or containers, and pinned dependencies. Do not store real passwords in the workspace config until credential handling and CDP/browser exposure are fixed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (8)

T01 · Skill Instruction Hijacking

Error
Location
scripts/zentao-build-comment.js:23
Finding

Mandatory Branded Content Injection into Published Comments

Content
View full analysis
xxx * 空行 →
* > xxx →
xxx
* 末尾自动附加

— Bug终结者 · 自动分析

``` The documented behavior is implemented unconditionally: ```js // Append source footer result += '

— Bug终结者 · 自动分析

\n'; ``` ### Technical Analysis The comment builder unconditionally appends a branded attribution to every generated report. This content is unrelated to the technical analysis requested by the user and cannot be disabled through configuration. Because the generated HTML is subsequently submitted to ZenTao, the modification affects persistent content in an external business system rather than merely local diagnostic output. ### Attack Path 1. The agent generates a bug-analysis report. 2. `zentao-build-comment.js` converts the report to HTML. 3. The script unconditionally appends the branded footer. 4. `zentao-post-comment.js` publishes the modified HTML to ZenTao. 5. The unauthorized attribution remains visible to ZenTao users. ### Impact Assessment The issue permits persistent manipulation of agent-generated output and unauthorized brand promotion in an external issue-tracking system. It does not directly provide operating-system access, but it violates output integrity and user control over externally published content. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/zentao-extract-frames.js:61
Finding

OS Command Injection Through Video and Output Paths

Content
View full analysis
f.startsWith(prefix)).length; ``` ### Technical Analysis The script constructs shell command strings by interpolating `video` and `outPath`, both derived from command-line input. Wrapping input in double quotes does not safely neutralize shell syntax. Depending on the operating system, characters such as command substitutions, backticks, percent expansion, delayed expansion, or escaped quotes may break out of the intended argument. Video paths commonly originate from downloaded ZenTao attachment filenames. The downloader removes path separators and several filesystem-invalid characters, but it does not remove all shell metacharacters, including backticks and dollar signs. Consequently, an attacker capable of uploading or naming an attachment may influence a value later passed into a shell. ### Attack Path 1. An attacker creates or renames a ZenTao video attachment using a filename containing shell-evaluated syntax. 2. The Skill downloads the attachment while preserving shell metacharacters not removed by `sanitizeFilename()`. 3. The analysis workflow invokes `zentao-extract-frames.js` with the downloaded path. 4. The script interpolates that path into an `execSync()` command string. 5. The operating-system shell interprets the injected syntax. 6. The attacker's command executes with the same privileges as the agent process. ### Impact Assessment ...[truncated 366 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/zentao-login.js:40
Finding

ZenTao Credentials Are Stored and Transmitted in Plaintext

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/zentao-download-files.js:107
Finding

Authenticated Browser Page Receives an Unrestricted Local File-Write Function

Content
View full analysis
{ if (!fileBuffers[filePath]) { fileBuffers[filePath] = { chunks: [], totalSize: 0, expectedSize: totalSize }; } const buf = Buffer.from(b64, 'base64'); fileBuffers[filePath].chunks.push({ offset, data: buf }); fileBuffers[filePath].totalSize += buf.length; if (isLast) { // 合并所有块：按 offset 排序后，使用各 chunk 的实际 offset 放置数据 const fb = fileBuffers[filePath]; fb.chunks.sort((a, b) => a.offset - b.offset); const merged = Buffer.alloc(fb.totalSize); for (const chunk of fb.chunks) { // 计算目标位置：使用 chunk 自身的 offset 作为在 merged buffer 中的起始位置 const writePos = chunk.offset - fb.chunks[0].offset; chunk.data.copy(merged, writePos); } fs.writeFileSync(filePath, merged); delete fileBuffers[filePath]; } }); ``` ### Technical Analysis `page.exposeFunction()` makes `window.__writeChunk` callable by JavaScript in the connected page. The callback trusts the page-supplied `filePath` and passes it directly to `fs.writeFileSync()`. No containment check ensures that the destination remains under `config.outputDir`. There is also no opaque transfer identifier, per-download authorization, size limit, offset validation, or verification that the call originated from the script's intended `page.evaluate()` operation. The Base64 conversion itself is not an exfiltration channel: it serializes binary attachment data from the browser context to local Node.js. The vulnerability is the unrestricted filesystem capability exposed to page JavaScript. ### Attack Path 1. The agent logs into ZenTao and connects Node.js to the authenticated page. 2. The downloa ...[truncated 666 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/zentao-build-comment.js:48
Finding

Unsafe Markdown Link Conversion Can Produce Injected HTML Attributes

Content
View full analysis
/g, '>'); } /** * 对已转义的文本应用内联 Markdown 格式化。 * 调用顺序：先 escapeHtml，再调用此函数。 */ function applyInlineFormatting(text) { // [text](url) → text（必须在 ** 之前，避免 url 中的内容被误处理） text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '$1'); // **bold** → bold text = text.replace(/\*\*(.+?)\*\*/g, '$1'); // *italic* → italic（单星号，小心不匹配 ** 的残片） text = text.replace(/(?$1'); // `code` → code text = text.replace(/`([^`]+)`/g, '$1'); return text; } ``` ### Technical Analysis `escapeHtml()` escapes ampersands and angle brackets but does not escape quotation marks. `applyInlineFormatting()` then inserts the captured Markdown URL directly into a double-quoted `href` attribute. A crafted URL containing a quotation mark can terminate the `href` value and add another attribute. The function also does not validate URL schemes, so dangerous schemes may be retained. Exploitability in a user's browser depends on whether ZenTao performs effective server-side HTML sanitization, but the Skill itself emits unsafe HTML and must not rely solely on a downstream system. ### Attack Path 1. Attacker-controlled bug content, comments, logs, or repository text contains a crafted Markdown-style link. 2. That content is incorporated into the generated report. 3. `escapeHtml()` leaves quotation marks unchanged. 4. `applyInlineFormatting()` inserts the value into `href="$2"`. 5. The resulting HTML contains attacker-controlled attributes or a dangerous URL. 6. The comment is posted to ZenTao. 7. If ZenTao does not remove the payload, it executes or triggers when a user view ...[truncated 401 chars]
Remediation
View remediation

other

Warning
Location
SKILL.md:41
Finding

Primary Source Repository Is Deliberately Left in a Mutated Detached-HEAD State

Content
View full analysis
` 分析完后不切回原分支（非 worktree 场景）。worktree 场景按步骤 6 清理。 ``` ```text - **仓库空闲**（无其他 Bug 分析占用）：`git checkout `（进入 detached HEAD 是正常行为，分析完成后保持不动即可）+ `git submodule update --init --recursive` - **同模块已有其他分析任务占用**：`git worktree add .claude/worktrees/bug-{bug_id}/ ` 创建隔离工作区，在 worktree 内执行 `git submodule update --init --recursive` ``` ### Technical Analysis Static source analysis only requires read access to a selected revision. The Skill instead directs the agent to modify the user's primary working tree using `git checkout ` and explicitly forbids restoring the original branch afterward. Recursive submodule updates further mutate the repository state and may fetch or execute repository-related behavior depending on local Git configuration and submodule state. The main issue is that a read-oriented analysis workflow unnecessarily alters the developer's active checkout. ### Attack Path 1. The Skill extracts a commit identifier from a bug attachment or log. 2. It runs `git checkout ` in the configured primary repository. 3. It updates submodules recursively. 4. Analysis completes. 5. The Skill deliberately leaves the repository at the selected detached commit. 6. The developer later edits or commits code under the incorrect repository state. ### Impact Assessment The workflow can interrupt active development, invalidate build state, alter submodule checkouts, and cause subsequent edits or commits to be made against an unintended revision. It does not inherently grant new operating-system privileges, but it exceeds the minimum filesystem privileges necessary for analysis. ]]>
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:8
Finding

Executable Dependencies and Browser Binaries Are Not Reproducibly Pinned

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/zentao-login.js:65
Finding

Authenticated Remote Content Is Processed with Chromium Sandbox Protections Disabled

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: zentao-bug-analyzer
description: "禅道缺陷自动分析：从飞书消息解析Bug链接，自动模块分类+分支定位+代码分析，Playwright评论+飞书通知双通道输出。"
---

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
- `auto_comment === true` 或未配置（默认视为 `true`）：运行 `zentao-post-comment.js` 评论 + 飞书摘要

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 363)May include surrounding context.

md
- `auto_comment === true` 或未配置（默认视为 `true`）：运行 `zentao-post-comment.js` 评论 + 飞书摘要

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
1. 运行 `scripts/zentao-login.js` 登录禅道，获取 WS endpoint（后续所有脚本复用此 endpoint）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.

md
1. 运行 `scripts/zentao-login.js` 登录禅道，获取 WS endpoint（后续所有脚本复用此 endpoint）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md
运行 `scripts/zentao-download-files.js` 下载 Bug 所有附件到 `bugs/{bug_id}/`。（script 自动处理大文件分块传输，支持 160MB+ 附件）

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md
node scripts/zentao-extract-frames.js --video=<视频路径> --dir=bugs/{bug_id}/frames --mode=coarse

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md
node scripts/zentao-extract-frames.js --video=<视频路径> --dir=bugs/{bug_id}/frames --mode=coarse

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

md
node scripts/zentao-extract-frames.js --video=<视频路径> --dir=bugs/{bug_id}/frames --mode=coarse

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The checklist instructs the agent to automatically post analysis results back to 禅道 comments and send a 飞书 summary by default, including when auto_comment is unset. This creates a real data-sharing risk because bug details, logs, code-derived conclusions, or internal analysis may be transmitted to external systems without an explicit user-facing consent step or sensitivity review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The cleanup checklist directs forceful process termination (kill -9, taskkill /F /T) and forced git worktree remove --force without any guardrails or user warning about operational impact. In the context of an agent skill, this is dangerous because it can kill unrelated child processes, disrupt active sessions, and delete working state if PID tracking or repository isolation is imperfect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

该 markdown 文件定义了“方式二：自然语言触发”，其中示例短语“帮我分析我名下所有未解决的缺陷”“分析最近 3 天指派给我的严重缺陷”属于较自然的日常请求表达，而文档未给出更严格的触发边界、限定上下文或负面示例。由于缺少清晰的激活/不激活条件，这类表述可能在普通飞书对话中与一般求助语句重叠，导致技能被意外调用。

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the user to provide a ZenTao username and password and explicitly stores the password in a local config file, while claiming it 'will not leak.' Persisting plaintext credentials in local configuration materially increases the risk of credential theft through local compromise, repo/workspace exposure, backups, logs, or accidental sharing.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The documentation instructs users to run npx playwright, which can fetch and execute the latest package version at install/runtime rather than a pinned, reviewed version. In an agent skill context, this creates a supply-chain risk: behavior can change over time or a compromised upstream release could execute unexpected code in the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code performs HTTP requests inside the browser context with credentials: 'include', which sends authenticated session data and retrieves potentially sensitive bug details and history. Although the file has informational logging, it does not disclose to the user that authenticated data will be transmitted and fetched from the Zentao instance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script prints and keeps alive a Chromium DevTools WebSocket endpoint tied to an already authenticated Zentao browser session. Any local user or process that can reach the debugging port or obtain the WS URL can attach to the browser, read page contents, execute actions as the logged-in user, and potentially extract cookies or other sensitive data; the risk is increased because the script provides no explicit warning or access restriction beyond localhost binding assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file’s user-facing natural-language content, including the header usage instructions and warnings, is exclusively in Chinese. That imposes a specific language on users without any opt-in or justification for a locale-specific scope, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script accepts a password via the --password=... command-line argument, which can expose credentials through shell history, process listings, CI logs, or audit telemetry. In a browser-automation utility that also supports remote CDP connection and account-based login, this increases the chance of credential disclosure during normal operational use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description is written as a Chinese-only phrase describing the skill as a Zentao defect auto-analysis script set. Under the policy criteria, forcing a specific language or locale without offering user choice can be a natural-language policy issue, and there is no indication here that the skill is intentionally region-specific or that users can opt in to this locale.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a caret range for playwright allows newer minor/patch releases to be installed implicitly, which can reduce build reproducibility and increase supply-chain risk if a bad or vulnerable release is published. In this skill context, Playwright is a powerful browser automation dependency, so unintended version drift can have meaningful security and operational consequences.

Content

Scanner excerpt · scripts/package.json (reported line 9)May include surrounding context.

json
"node": ">=18"
  },
  "dependencies": {
    "playwright": "^1.40.0"
  },
  "devDependencies": {
    "@ffmpeg-installer/ffmpeg": "^1.1.0",

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
81% confidence
Finding

The manifest includes Playwright without exact version pinning while there is a known advisory affecting some Playwright releases related to downloading and installing browsers without authenticity verification. Because the allowed version range is not exact, it is not possible to confirm from this file alone whether installations avoid affected versions, creating uncertainty and potential exposure in an automation-heavy skill.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The caret version for @ffmpeg-installer/ffmpeg permits automatic dependency drift, which creates a supply-chain integrity and reproducibility issue. Although this is a devDependency, it still executes in developer or CI environments and could expose those environments to a compromised or vulnerable release.

Content

Scanner excerpt · scripts/package.json (reported line 12)May include surrounding context.

json
"playwright": "^1.40.0"
  },
  "devDependencies": {
    "@ffmpeg-installer/ffmpeg": "^1.1.0",
    "ffprobe-static": "^3.1.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The unpinned ffprobe-static version allows non-deterministic installs and increases supply-chain exposure if an upstream release is malicious or flawed. Because it is a devDependency, the primary risk is to build and analysis environments rather than direct runtime compromise of deployed users.

Content

Scanner excerpt · scripts/package.json (reported line 13)May include surrounding context.

json
},
  "devDependencies": {
    "@ffmpeg-installer/ffmpeg": "^1.1.0",
    "ffprobe-static": "^3.1.0"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains natural-language strings entirely in Chinese, including the usage/help text and the appended footer. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file header documents the rule '- xxx →

- xxx

', implying dash-prefixed lines are converted into paragraph tags. However, the implementation groups consecutive '- ' lines into a '
    ' with '
  • ' items at L166-L176. This is an active contradiction between documentation and behavior, not just an omitted detail.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/zentao-extract-frames.js:66

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/zentao-utils.js:66