registry / @makerx/yoke / 0.13.1
@makerx/yoke@0.13.1
Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe findings are consistent with the package's purpose: it routes review work and configured credentials to the chosen model provider, and its skill writes occur through the sync command. The package manifest has no install hook, and review posting is separately requested with --post.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs a yoke CLI command, such as review or sync.
Impact
Expected review and skill setup behavior; no unsolicited credential forwarding or automatic account action was identified.
Mechanism
Review uses the configured model provider and can post findings with --post; sync writes the package's Claude skills to the chosen skill directory.
AI rationale
The findings are consistent with the package's purpose: it routes review work and configured credentials to the chosen model provider, and its skill writes occur through the sync command. The package manifest has no install hook, and review posting is separately requested with --post.
Network endpoints3
login.microsoftonline.comtoken.actions.githubusercontent.comuser-configured provider base URL
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has no install, preinstall, or postinstall hook; its lifecycle script is prepublishOnly build.
- Provider endpoints are derived from the configured base URL, and credentials are passed to that provider for the selected model harness.
- The review command fetches PR data and sends review work to configured reviewers; posting findings requires the --post option.
- The CLI writes its bundled Claude skills to the selected skill directory through its explicit sync command.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli.jsView file
290// src/features/pr/raise.ts
L291: import { execFileSync } from "child_process";
L292:
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"litellm.baseUrl": setting("LiteLLM proxy URL"),
"litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
"foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
"foundry.apiKey": secret("Foundry API key. Env or --user config only"),
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
"Repo-level config is not supported: it would put the API key in the repo. Pass --user to write the user-level yoke config."
writeFileSync(path, `${JSON.stringify(file, null, 2)}
import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileS
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg2072async function claudeSignedIn() {
L2073: const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
L2074: if (!ok) return false;
...
L2083: try {
L2084: const response = await fetch(url, {
L2085: method: "POST",
L2086: headers: { "Content-Type": "application/json", ...headers },
L2087: body: JSON.stringify(body),
L2088: signal: AbortSignal.timeout(probeTimeout)
Findings
6 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.13.1.
See all versions of @makerx/yoke for other recorded verdicts.
- Review the evidence and your use of @makerx/yoke@0.13.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.