registry / @makerx/yoke / 0.11.0
@makerx/yoke@0.11.0
Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest has no install hook, and the flagged CLI behavior is consistent with the package’s documented review and skill-management purpose. Credentials are used with configured provider endpoints, while the Azure token exchange follows the GitHub Actions OIDC flow.
Static reason
One or more suspicious static signals were detected.
Trigger
Explicit invocation of commands such as yoke review, yoke sync, or yoke review-ci.
Impact
Expected review and setup behavior; no automatic credential collection, unrelated transmission, or hidden configuration change was identified.
Mechanism
The CLI runs review tools and routes credentials to the configured provider; sync writes the package’s skills to the documented Claude skills directory.
AI rationale
The manifest has no install hook, and the flagged CLI behavior is consistent with the package’s documented review and skill-management purpose. Credentials are used with configured provider endpoints, while the Azure token exchange follows the GitHub Actions OIDC flow.
Evidence
.claude/skills~/.claude/skills
Network endpoints3
login.microsoftonline.comtoken.actions.githubusercontent.comGitHub/provider endpoints used by explicitly invoked CLI features
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/cli.js as a CLI binary and has no install lifecycle hook; prepublishOnly only builds the package.
- Provider URLs and API credentials are supplied through settings or environment variables, and the CLI derives request endpoints from the configured base URL.
- The Entra token exchange uses GitHub Actions OIDC and sends the assertion to login.microsoftonline.com for a Foundry access token.
- Review and skill synchronization are documented as user-invoked CLI commands.
Evidence against
- The CLI uses child-process execution, network requests, and filesystem writes as part of its review, configuration, and skill-management functions.
- Review credentials are passed to the selected provider endpoint; a user-configured endpoint could be a third-party service.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli.jsView file
290// src/features/pr/raise.ts
L291: import { execFileSync } from "child_process";
L292:
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"litellm.baseUrl": setting("LiteLLM proxy URL"),
"litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
"foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
"foundry.apiKey": secret("Foundry API key. Env or --user config only"),
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
"Repo-level config is not supported: it would put the API key in the repo. Pass --user to write the user-level yoke config."
writeFileSync(path, `${JSON.stringify(file, null, 2)}
import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileS
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg1950async function claudeSignedIn() {
L1951: const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
L1952: if (!ok) return false;
...
L1961: try {
L1962: const response = await fetch(url, {
L1963: method: "POST",
L1964: headers: { "Content-Type": "application/json", ...headers },
L1965: body: JSON.stringify(body),
L1966: signal: AbortSignal.timeout(probeTimeout)
Findings
6 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.11.0.
See all versions of @makerx/yoke for other recorded verdicts.
- Review the evidence and your use of @makerx/yoke@0.11.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.