Security audit

禅道-ZenTao

Security checks across malware telemetry and agentic risk

Overview

This ZenTao integration is mostly purpose-aligned, but it exposes broad write and delete abilities without consistently enforcing the confirmations its documentation promises.

Install only if you are comfortable letting the skill use a ZenTao account for both reads and possible writes. Prefer a least-privilege or read-only ZenTao account, protect TOOLS.md, and require manual review before any create, update, delete, review, or test-run action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The module reads endpoint, username, and password from a local TOOLS.md file in the user's workspace, effectively harvesting credentials from a file outside the immediate API-client responsibility. In an agent/skill context, this is more dangerous because the code can silently access secrets available in the runtime environment and use them to authenticate to external systems without explicit user approval.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The code labels these as write operations that 'need confirmation' but implements direct create/review/test-execution actions with no confirmation gate, dry-run mode, or authorization check. In an agent setting, this materially increases risk because an LLM or calling workflow could perform state-changing operations against a production ZenTao instance automatically and unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The client includes hidden credential discovery logic that reads ZenTao endpoint, username, and password from a local TOOLS.md file under the user's home directory. In an agent-skill context, this expands the component from a simple REST wrapper into a credential-harvesting mechanism, enabling use of stored secrets without explicit user consent or transparent configuration flow.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Sensitive credentials are loaded from a local file without any user-facing warning, consent, or indication that secrets will be accessed. Within a skill environment, this hidden secret access is especially risky because users may invoke the skill for benign reads while the code silently consumes stored credentials to reach privileged systems.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The module exposes write-capable API methods that can create stories, tasks, plans, approve reviews, and run test cases without any user-facing warning or confirmation. In the context of an agent skill, hidden mutating capabilities are more dangerous than in a normal library because they can be triggered indirectly by prompts or orchestration logic, leading to unauthorized changes in external systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code silently reads credentials from ~/.openclaw/workspace/TOOLS.md and parses out API address, username, and password without any user-facing warning. This is dangerous because it accesses potentially sensitive local data implicitly, making secret use non-obvious and increasing the chance of unauthorized credential reuse by downstream agent behavior.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The script prints the ZenTao API endpoint and username on startup, which can disclose internal infrastructure details and account identifiers to terminal logs, screen recordings, CI output, or shared shells. While it does not expose the password, this still increases reconnaissance value and may leak operational metadata unnecessarily.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.