Security audit

zentao-bug-analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill appears to support a real Zentao bug-analysis workflow, but it needs Review because it stores credentials locally, exposes an authenticated browser session, changes local git repositories, and posts bug comments by default.

Install only if you are comfortable giving the skill access to a live Zentao account, private bug attachments, local code repositories, and the ability to publish comments. Use a least-privilege Zentao account, set auto_comment to false unless automatic posting is explicitly desired, keep the config file out of source control and backups, update Playwright, and run it only in repositories or worktrees where git checkout and cleanup commands cannot disrupt unrelated work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The checklist directs forceful process termination and Git workspace removal (`taskkill /F /T`, `kill -9`, `git worktree remove --force`) without any stated scope restriction, ownership verification, or safety checks. In an agent skill, these are destructive host-level actions that can disrupt unrelated user work or delete workspace state if variables, PIDs, or paths are wrong.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs broad local repository manipulation (`git checkout`, `git worktree add/remove`, `git submodule update`) and aggressive process termination (`taskkill`, `kill -9`, `pkill`) as part of normal operation. Even if intended for cleanup and branch analysis, these actions can disrupt unrelated local work, destroy uncommitted state, or terminate unintended processes if context or PID tracking is wrong.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The documentation tells the user to provide a Zentao account password and says it 'will not be leaked' while also storing it locally in configuration. Storing reusable plaintext credentials on disk materially increases the risk of credential theft via local compromise, accidental disclosure, backups, logs, or repo inclusion.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The checklist mandates posting analysis results to Zentao and sending a Feishu summary, which can transmit bug details, logs, attachments, or inferred conclusions to external systems without an explicit consent, minimization, or sensitivity review step. For bug-analysis workflows, this can expose confidential operational details or internal code/security context beyond the local analysis environment.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The cleanup instructions include forceful termination and forced worktree deletion without warning or precondition checks, creating risk of killing unrelated processes or deleting uncommitted workspace state. In an automated skill, omission of user-facing safeguards makes accidental destructive impact more likely.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The natural-language trigger examples are broad enough that normal conversation could unintentionally invoke a workflow that logs into Zentao, downloads attachments, analyzes code, and potentially posts comments. Because the triggered actions are high impact, accidental activation creates unnecessary access and side effects without strong confirmation boundaries.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill performs high-impact behaviors including local file writes, attachment downloads, git state changes, credential use, and external comment posting, but the documentation lacks a consolidated warning and consent model covering these risks. Users may not fully understand that routine use can modify repositories, persist sensitive bug artifacts, and publish analysis back to the tracking system.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document instructs consumers to authenticate by logging in with Playwright and then issuing requests with session cookies included, but it gives no warning that these requests operate with the user's live authenticated privileges. In an agent-skill context, this can normalize credentialed cross-system access and lead to unintended data retrieval or actions against the ZenTao instance.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The file documents how to post bug comments to the remote ZenTao system but does not warn that this is a state-changing operation. In an agent-driven workflow, this omission increases the risk of unauthorized or accidental modification of production issue records, including injection of misleading or sensitive content into tracked bugs.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The attachment download section explains how to retrieve files, including large files, without warning that attachments may contain sensitive or regulated data and that downloads exfiltrate that data into the agent environment. In this context, the operational detail makes large-scale authenticated file retrieval easier and therefore increases exposure risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script launches Chromium with a remote debugging port and then retrieves and prints the DevTools WebSocket URL for a browser already authenticated to Zentao. Any local user, process, log collector, or downstream tool that can read stdout or connect to the debugging port can hijack the session, inspect page content, perform authenticated actions, and potentially extract sensitive data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script accepts a password via the --password=... command-line argument, which can expose credentials through shell history, process listings, job logs, and audit trails on the host. In an automation utility that may run in shared CI, remote shells, or multi-user systems, this creates a realistic credential leakage risk even if no explicit exfiltration code is present.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The setup guidance explicitly asks for the user's Zentao password and persists it locally, creating a sensitive-secret storage issue. The accompanying assurance that it 'will not leak' is particularly problematic because it may reduce user caution despite the absence of strong protections for stored credentials.

Known Vulnerable Dependency: playwright==1.40.0 — 1 advisory(ies): CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)

High

Category: Supply Chain
Confidence: 90% confidence
Finding: The manifest includes Playwright 1.40.0, which is flagged with a known advisory indicating browser binaries may be downloaded and installed without authenticity verification. In this skill context, that is more dangerous because Playwright commonly performs automated browser setup, creating a realistic path for supply-chain compromise or execution of tampered browser binaries in developer or CI environments.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/zentao-extract-frames.js:66

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/zentao-utils.js:66