首页龙虾技能列表 › Zentao API Skills(禅道 API 技能) — 技能工具

Zentao API Skills(禅道 API 技能) — 技能工具

v1.0.3

调用禅道(ZenTao)RESTful API v2.0 完成用户请求,覆盖项目集、产品、项目、执行、需求(Story/Epic/Requirement)、Bug、任务、测试用例、测试单、产品计划、版本、发布、反馈、工单、应用、用户、文件等 20 个模块的增删改查及状态流转操作。当用户提到禅道、zentao、查询...

0· 360·0 当前·0 累计
by @catouse·MIT-0
下载技能包
License
MIT-0
最后更新
2026/4/10
安全扫描
VirusTotal
可疑
查看报告
OpenClaw
可疑
medium confidence
The skill generally fits a ZenTao API connector, but the metadata, runtime instructions, and the included get-token.sh script are inconsistent and contain a small but real safety concern (use of eval on unquoted output and undocumented runtime dependencies).
评估建议
This skill appears to be a legitimate ZenTao API connector, but note three important things before installing: 1) The package metadata does not declare the environment variables (ZENTAO_URL, ZENTAO_TOKEN, ZENTAO_ACCOUNT, ZENTAO_PASSWORD) or binaries (curl, node) that SKILL.md requires — expect to provide these manually. 2) The provided scripts/get-token.sh caches your token and account in ~/.zentao-token.json (plaintext JSON). If you care about stored credentials, inspect or change the cache loc...
详细分析 ▾
用途与能力
The skill's name/description describe a ZenTao API connector which legitimately needs a server URL and an auth token or account/password. However, the registry metadata declares no required environment variables or required binaries, while SKILL.md and scripts clearly rely on ZENTAO_URL, ZENTAO_TOKEN, ZENTAO_ACCOUNT, ZENTAO_PASSWORD and on curl and node. This mismatch is incoherent and should have been declared.
指令范围
Runtime instructions direct the agent (and user) to run eval "$(bash scripts/get-token.sh)". The script reads/writes ~/.zentao-token.json, performs network login, and prints shell assignments. Using eval on script output can be unsafe if the printed values contain shell metacharacters; token/account values originating from the server or from the cache may result in accidental command execution. The general API call flow (construct request, confirm write operations, call endpoints) is otherwise in-scope for the described purpose.
安装机制
No install spec (instruction-only) — lowest installation risk. The only code file is scripts/get-token.sh which will be run by the user/agent. No remote downloads or archive extraction are present.
凭证需求
Requesting a ZenTao URL, token, or account/password is proportionate to the stated purpose. However these credentials are not declared in the registry metadata (incoherent). The script caches token/account in plaintext at ~/.zentao-token.json, which is expected for convenience but increases persistence of secrets on disk and should be highlighted to users.
持久化与权限
The skill is not always-enabled and does not request elevated system privileges. It does write a cache file (~/.zentao-token.json) in the user's home directory and will create/overwrite that file when a token is obtained — this is within scope but is persistent state and should be disclosed to the user.
安全有层次,运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发,无需署名。

运行时依赖

无特殊依赖

版本

latestv1.0.32026/3/18

Version 1.0.3 - 增强必填字段规范,完善常用接口必填/可选字段与枚举说明 - 新增列表接口的分页与状态筛选参数说明,覆盖参数名差异及用法 - 明确字段名、状态流转接口与普通 PUT 编辑接口的区别与调用方法 - 补充模块支持详情,修正部分资源未有全局列表接口 (CUD) 的说明 - 调整示例与字段命名,确保与 API v2.0 一致 - 丰富“注意事项”、常用枚举值与速查表,有助于调用更精确

● 可疑

安装命令 点击复制

官方npx clawhub@latest install zentao-api
镜像加速npx clawhub@latest install zentao-api --registry https://cn.clawhub-mirror.com

技能文档

配置

优先级从高到低:

变量说明
ZENTAO_URL服务器地址,如 http://zentao.example.com
ZENTAO_TOKEN直接指定 token,跳过登录和缓存(最高优先级),仍需提供服务器地址
ZENTAO_ACCOUNT登录账号,有 token 时可选,但提供可更好回答与当前用户相关的问题
ZENTAO_PASSWORD登录密码,有 token 时无需提供
首次登录后 ZENTAO_URLZENTAO_TOKENZENTAO_ACCOUNT 写入 ~/.zentao-token.json,后续无需重复设置

若必要变量缺失,提示用户并给出 export 命令。用户直接提供服务器、账号和密码时直接使用,同时告知尽量设为环境变量。

认证流程

所有业务 API 需在 Header 携带 token。运行 scripts/get-token.sh 自动获取:

eval "$(bash scripts/get-token.sh)"
# 执行后可直接使用 $ZENTAO_URL、$ZENTAO_TOKEN、$ZENTAO_ACCOUNT

脚本依赖:curlnode

后续所有请求 Header 携带:token: $ZENTAO_TOKEN

执行 API 调用的步骤

  • 运行 eval "$(bash scripts/get-token.sh)" 获取凭证(自动处理缓存;仍缺失时提示用户)
  • 根据用户意图选择正确的 API 端点(参见 api-reference.md
  • 若为 PUT 编辑操作且用户未提供全部必填字段,先调用对应 GET 详情接口取回当前数据,再将用户指定的字段覆盖进去
  • 构造请求(方法、URL、Header、Body)并向用户确认写操作内容
  • 执行请求,解析响应
  • 以清晰易读的格式向用户展示结果

模块总览

API 基础路径:$ZENTAO_URL/api.php/v2

模块资源路径支持操作
项目集 Program/programsCRUD + 关联产品/项目列表
产品 Product/productsCRUD + 关联需求/Bug/用例/计划/发布/反馈/工单/测试单/应用
项目 Project/projectsCUD + 关联执行/需求/Bug/用例/版本/测试单
执行 Execution/executionsCRUD + 关联需求/任务/Bug/用例/版本/测试单
需求 Story/storiesCRUD + change/close/activate
业务需求 Epic/epicsCRUD + change/close/activate
用户需求 Requirement/requirementsCRUD + change/close/activate
Bug/bugsCRUD + resolve/close/activate
任务 Task/tasksCRUD + start/finish/close/activate
测试用例 Testcase/testcasesCRUD
产品计划 Productplan/productplansCUD + 按产品查列表
版本 Build/buildsCUD + 按项目/执行查列表
发布 Release/releasesCUD + 按产品查列表
测试单 Testtask/testtasksCUD + 按产品/项目/执行查列表
反馈 Feedback/feedbacksCRUD + close/activate
工单 Ticket/ticketsCRUD + close/activate
应用 System/systemsCU + 按产品查列表
用户 User/usersCRUD
文件 File/files编辑名称 + 删除
CRUD = 创建(POST) + 读取(GET) + 更新(PUT) + 删除(DELETE);CUD = 无独立全局列表接口

分页与筛选

所有列表接口支持统一的查询参数:

参数说明
browseTypestatus筛选状态,如 all, doing, unclosed, undone 等(不同模块参数名和可选值不同,详见 api-reference.md
orderBy排序,格式 字段_asc字段_desc,如 id_desc, title_asc
recPerPage每页数量,最大 1000
pageID页码,从 1 开始
筛选参数名不一致:Program 列表、Execution 全局列表、Task 列表用 status,其余用 browseType

常用操作示例

获取进行中的项目及其执行

curl -s "$ZENTAO_URL/api.php/v2/projects?browseType=doing&recPerPage=100" -H "token: $ZENTAO_TOKEN"
curl -s "$ZENTAO_URL/api.php/v2/projects/{projectID}/executions?browseType=doing" -H "token: $ZENTAO_TOKEN"

创建需求(必填:productID, title)

curl -s -X POST "$ZENTAO_URL/api.php/v2/stories" \
  -H "token: $ZENTAO_TOKEN" -H "Content-Type: application/json" \
  -d '{"productID": 1, "title": "需求标题", "pri": 3, "assignedTo": "admin", "spec": "需求描述"}'

创建 Bug(必填:productID, title, openedBuild)

curl -s -X POST "$ZENTAO_URL/api.php/v2/bugs" \
  -H "token: $ZENTAO_TOKEN" -H "Content-Type: application/json" \
  -d '{"productID": 1, "title": "Bug标题", "openedBuild": ["trunk"], "severity": 2, "type": "codeerror"}'

解决 Bug(必填:resolution)

curl -s -X PUT "$ZENTAO_URL/api.php/v2/bugs/{bugID}/resolve" \
  -H "token: $ZENTAO_TOKEN" -H "Content-Type: application/json" \
  -d '{"resolution": "fixed"}'

创建任务(必填:name, executionID)

curl -s -X POST "$ZENTAO_URL/api.php/v2/tasks" \
  -H "token: $ZENTAO_TOKEN" -H "Content-Type: application/json" \
  -d '{"executionID": 1, "name": "任务名", "type": "devel", "assignedTo": "admin", "estimate": 4}'

完成任务(必填:currentConsumed, realStarted, finishedDate)

curl -s -X PUT "$ZENTAO_URL/api.php/v2/tasks/{taskID}/finish" \
  -H "token: $ZENTAO_TOKEN" -H "Content-Type: application/json" \
  -d '{"currentConsumed": 4, "realStarted": "2026-03-25", "finishedDate": "2026-03-25"}'

关闭需求(必填:closedReason)

curl -s -X PUT "$ZENTAO_URL/api.php/v2/stories/{storyID}/close" \
  -H "token: $ZENTAO_TOKEN" -H "Content-Type: application/json" \
  -d '{"closedReason": "done"}'

常用枚举值速查

字段可选值
项目模式 modelscrum, waterfall, kanban, agileplus, waterfallplus
Bug 类型 typecodeerror, config, install, security, performance, standard, automation, designdefect, others
Bug 解决方案 resolutionfixed, notrepro, bydesign, duplicate, external, postponed, willnotfix, tostory
需求关闭原因 closedReasondone, subdivided, duplicate, postponed, willnotdo, cancel, bydesign
需求来源 sourcecustomer, user, po, market, service, operation, support, competitor, partner, dev, tester, bug, forum, other
需求类别 categoryfeature, interface, performance, safe, experience, improve, other
用例类型 typeunit, interface, feature, install, config, performance, security, other
测试单类型 typeintegrate, system, acceptance, performance, safety
发布状态 statuswait, normal, fail, terminate
反馈关闭原因 closedReasoncommented, repeat, refuse
工单类型 typecode, data, stuck, security, affair
产品类型 typenormal, branch, platform
产品访问控制 aclopen, private
执行类型 lifetimeshort, long, ops

意图识别规则

用户意图关键词对应操作
进行中的执行/迭代/SprintGET /projects?browseType=doing → GET /projects/{id}/executions
获取所有产品/项目/项目集GET /products, /projects, /programs
某产品/项目/执行的 BugGET /products/{id}/bugs, /projects/{id}/bugs, /executions/{id}/bugs
创建/新增 BugPOST /bugs(必填:productID, title, openedBuild)
更新/修改 BugPUT /bugs/{id}
解决 BugPUT /bugs/{id}/resolve(必填:resolution)
关闭 BugPUT /bugs/{id}/close
激活 BugPUT /bugs/{id}/activate
创建需求POST /stories(必填:productID, title)
关闭/激活/变更需求PUT /stories/{id}/close, /activate, /change
业务需求/epics(同 stories 结构)
用户需求/requirements(同 stories 结构)
创建任务POST /tasks(必填:name, executionID)
启动任务PUT /tasks/{id}/start(必填:realStarted)
完成任务PUT /tasks/{id}/finish(必填:currentConsumed, realStarted, finishedDate)
关闭任务PUT /tasks/{id}/close
测试用例/testcases(CRUD)
测试单/testtasks(CUD + 按产品/项目/执行查列表)
产品计划/productplans(CUD + 按产品查列表)
版本/Build/builds(CUD + 按项目/执行查列表)
发布/releases(CUD + 按产品查列表)
反馈/feedbacks(CRUD + close/activate)
工单/tickets(CRUD + close/activate)
应用/系统/systems(CU + 按产品查列表)
获取用户列表GET /users

注意事项

  • URL 中的 {id} 需替换为实际 ID;不知道 ID 时先调列表接口获取
  • PUT 编辑接口:先 GET 详情获取当前完整数据,再将用户修改的字段覆盖进去一并提交
  • 状态流转操作 (resolve/close/activate/start/finish/change) 通常有独立的必填字段,不需要先 GET 详情
  • 写操作前向用户确认,用户明确要求不确认则直接执行
  • 401 响应表示 token 已失效,执行 rm ~/.zentao-token.json 清除缓存后重新运行
  • 字段名不一致注意:POST builds 用 executionID,PUT builds 用 execution;PUT testcases 的模块字段为 moudule(规范中的拼写)

完整 API 参考

详细的端点列表、必填/可选字段、枚举值和查询参数见 api-reference.md

备用资源

  • 禅道 API 2.0 官方文档:https://www.zentao.net/book/api/2309.html
  • 1.0 API 文档(备用):https://www.zentao.net/book/api/1397.html
数据来源:ClawHub ↗ · 中文优化:龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制

免费技能或插件可能存在安全风险,如需更匹配、更安全的方案,建议联系付费定制

了解定制服务