Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add easysoft/zentao-skills --skill zentao-apigit clone --depth 1 https://github.com/easysoft/zentao-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/easysoft/zentao-skills/zentao-api)<a href="https://agentmods.dev/skills/easysoft/zentao-skills/zentao-api"><img src="https://agentmods.dev/badge/skills/easysoft/zentao-skills/zentao-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/easysoft/zentao-skills/zentao-api"><img src="https://agentmods.dev/badge/skills/easysoft/zentao-skills/zentao-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 220 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Data Exfiltration · line 96 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.03355 |
| Opus 5.5 | $0.00050 | $0.01342 |
| Sonnet 5.5 | $0.00025 | $0.00671 |
| Haiku 4.5 | $0.00012 | $0.00335 |
Grade A, and why
zentao-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
脚本依赖：`curl`、`node` How it starts
The opening of the file, as written. The whole thing — 231 lines — stays where its author put it; the contents beside it link to each section on GitHub.
禅道 API v2.0
配置
优先级从高到低：
| 变量 | 说明 |
|---|---|
ZENTAO_URL |
服务器地址，如 http://zentao.example.com |
ZENTAO_TOKEN |
直接指定 token，跳过登录和缓存（最高优先级），仍需提供服务器地址 |
ZENTAO_ACCOUNT |
登录账号，有 token 时可选，但提供可更好回答与当前用户相关的问题 |
ZENTAO_PASSWORD |
登录密码，有 token 时无需提供 |
首次登录后 ZENTAO_URL、ZENTAO_TOKEN、ZENTAO_ACCOUNT 写入 ~/.zentao-token.json，后续无需重复设置。
若必要变量缺失，提示用户并给出 export 命令。用户直接提供服务器、账号和密码时直接使用，同时告知尽量设为环境变量。
认证流程
所有业务 API 需在 Header 携带 token。运行 scripts/get-token.sh 自动获取：
eval "$(bash scripts/get-token.sh)"
# 执行后可直接使用 $ZENTAO_URL、$ZENTAO_TOKEN、$ZENTAO_ACCOUNT
脚本依赖：curl、node
后续所有请求 Header 携带：token: $ZENTAO_TOKEN
执行 API 调用的步骤
- 运行
eval "$(bash scripts/get-token.sh)"获取凭证（自动处理缓存；仍缺失时提示用户） - 根据用户意图选择正确的 API 端点（参见 api-reference.md）
- 若为 PUT 编辑操作且用户未提供全部必填字段，先调用对应 GET 详情接口取回当前数据，再将用户指定的字段覆盖进去
- 构造请求（方法、URL、Header、Body）并向用户确认写操作内容
- 执行请求，解析响应
- 以清晰易读的格式向用户展示结果
模块总览
API 基础路径：$ZENTAO_URL/api.php/v2
| 模块 | 资源路径 | 支持操作 |
|---|---|---|
| 项目集 Program | /programs |
CRUD + 关联产品/项目列表 |
| 产品 Product | /products |
CRUD + 关联需求/Bug/用例/计划/发布/反馈/工单/测试单/应用 |
| 项目 Project | /projects |
CUD + 关联执行/需求/Bug/用例/版本/测试单 |
| 执行 Execution | /executions |
CRUD + 关联需求/任务/Bug/用例/版本/测试单 |
| 需求 Story | /stories |
CRUD + change/close/activate |
| 业务需求 Epic | /epics |
CRUD + change/close/activate |
| 用户需求 Requirement | /requirements |
CRUD + change/close/activate |
| Bug | /bugs |
CRUD + resolve/close/activate |
| 任务 Task | /tasks |
CRUD + start/finish/close/activate |
| 测试用例 Testcase | /testcases |
CRUD |
| 产品计划 Productplan | /productplans |
CUD + 按产品查列表 |
| 版本 Build | /builds |
CUD + 按项目/执行查列表 |
| 发布 Release | /releases |
CUD + 按产品查列表 |
| 测试单 Testtask | /testtasks |
CUD + 按产品/项目/执行查列表 |
| 反馈 Feedback | /feedbacks |
CRUD + close/activate |
| 工单 Ticket | /tickets |
CRUD + close/activate |
| 应用 System | /systems |
CU + 按产品查列表 |
| 用户 User | /users |
CRUD |
| 文件 File | /files |
编辑名称 + 删除 |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 231 lines · 124 tokens per session scan A 331c4238f310
zentao-api is a skill published in the GitHub repository easysoft/zentao-skills (76 stars, last pushed 1mo ago), licensed MIT. It adds 124 tokens to every session and 3,355 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
team-qa
Orchestrate the QA team through a full testing cycle — qa-lead strategy and test plan, qa-tester case writing, execution, sign-off.
scaffold-dotnet-test-project
MUST USE when an existing .NET test project was excluded from a .slnf/CI solution filter, disappeared from .sln/.slnx discovery, or lost its production ProjectReference; also for requests to set up, create, reuse, add, register, include, or repair a test project. Handles "tests pass directly but CI discovers zero"…
test-result-feedback
Close the acceptance loop for a tested change — consume the apc test TierResult, map EACH acceptance criterion to a pass/fail outcome from structured fields (never chat text), attach an evidence ref, and write it back to the task. A SUT red is a finding, never softened to green.
conductor-implement
Execute tasks from a track's implementation plan following TDD workflow.
cy-execute-task
Implement and verify an existing CompozyOS spec task, then update its tracking. Excludes review remediation.
implement-feature
Implement an approved feature plan with benefit-based placement, TDD, revision-bound evidence, and PR-ready output.