zentao-user
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instruction for user creation (found in
references/zentao-user-create.md) uses the--passwordflag to pass the user's password as a plain-text command-line argument. This is an insecure practice as it allows the password to be exposed in system process listings, shell history, and potentially system logs. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes user-controlled data from an external system (ZenTao).
- Ingestion points: Untrusted data enters the agent context through the
zentao-cli user listandzentao-cli user getcommands, which fetch user accounts and real names. - Boundary markers: The skill does not define delimiters or specific instructions to the agent to disregard instructions embedded within the user data.
- Capability inventory: The skill has high-impact capabilities including
user create,user update, anduser deletefunctions. - Sanitization: There is no mechanism described to sanitize or validate strings retrieved from the ZenTao API before they are evaluated by the agent.
Audit Metadata