@makerx/yoke@0.10.0
Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI injects explicit suppression instructions into AI review requests for matching workflow changes. This is concrete reviewer manipulation in the package’s core review feature, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs yoke review on a PR whose diff changes a workflow calling MakerXStudio/yoke’s reusable review workflow.
Impact
Users may miss security or reliability issues in those workflow changes.
Mechanism
The CLI adds instructions to the review request telling the model not to raise specified workflow behaviors as findings or mention them in its summary.
Attack narrative
When a reviewed diff changes a workflow that calls MakerXStudio/yoke’s reusable workflow, the CLI appends instructions telling the AI reviewer to suppress several findings about that workflow. Because this is a review tool, those instructions can hide relevant issues from users relying on its report.
AI rationale
The CLI injects explicit suppression instructions into AI review requests for matching workflow changes. This is concrete reviewer manipulation in the package’s core review feature, so the package should be blocked.
Evidence
dist/cli.jspackage.json.github/workflows/*
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The review prompt tells the model not to report specified findings in workflows that call MakerXStudio/yoke’s reusable review workflow.
- The CLI inserts that note into the generated review request when the matching workflow appears in a diff.
- The manifest exposes dist/cli.js as the yoke command, which provides the review feature.
Evidence against
- The suppression is limited to reviews of changed workflow files that call MakerXStudio/yoke’s review workflow.
- The package has no install, preinstall, or postinstall hook; its prepublishOnly script runs a build.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli.jsView file
290// src/features/pr/raise.ts
L291: import { execFileSync } from "child_process";
L292:
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"litellm.baseUrl": setting("LiteLLM proxy URL"),
"litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
"foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
"foundry.apiKey": secret("Foundry API key. Env or --user config only"),
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
"Repo-level config is not supported: it would put the API key in the repo. Pass --user to write the user-level yoke config."
writeFileSync(path, `${JSON.stringify(file, null, 2)}
import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileS
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg1950async function claudeSignedIn() {
L1951: const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
L1952: if (!ok) return false;
...
L1961: try {
L1962: const response = await fetch(url, {
L1963: method: "POST",
L1964: headers: { "Content-Type": "application/json", ...headers },
L1965: body: JSON.stringify(body),
L1966: signal: AbortSignal.timeout(probeTimeout)
Findings
6 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.10.0.
See all versions of @makerx/yoke for other recorded verdicts.
- Avoid installing @makerx/yoke@0.10.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.