Yoyoalphax Zentao1

Integrates ZenTao project management APIs to query and manage products, projects, executions, stories, tasks, bugs, and related data via unified interface.

This skill appears to do what it claims: it will read ZenTao credentials from a local TOOLS.md file and call the ZenTao REST/legacy APIs. Before installing or running it: (1) inspect the TOOLS.md file and avoid committing it to version control—consider using environment variables or a secrets manager instead; (2) review the included Python files yourself (they currently form requests to the user-supplied ZenTao endpoint, which is expected) and run in an isolated virtual environment prior to installing dependencies; (3) note a minor metadata inconsistency (owner/slug/version differences across _meta.json, package.json, and the registry metadata) — this is not necessarily malicious but worth verifying the publisher's identity if you require provenance; (4) if you must run this in a production environment, prefer a least-privilege account on the ZenTao instance and audit any network traffic to ensure credentials are only sent to your ZenTao host.

Type: OpenClaw Skill Name: yoyoalphax-zentao1 Version: 1.0.0 The ZenTao Project Management skill provides a legitimate integration with the ZenTao API (both REST and legacy versions). It follows standard OpenClaw patterns by reading user-provided credentials from a local configuration file (TOOLS.md) and includes safety features such as mandatory user confirmation for write operations (create, update, delete) within the CLI script (zentao_cli.py). No evidence of data exfiltration, malicious execution, or harmful prompt injection was found.