@makerx/yoke@0.14.0
Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe CLI contains a conditional reviewer-manipulation instruction that explicitly suppresses findings and summaries for selected workflow changes. This is a concrete review-integrity attack, even though the credential routing inspected is based on the configured provider endpoint.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the review command on a PR whose workflow diff calls MakerXStudio/yoke/.github/workflows/review.yml.
Impact
AI reviewers may omit security findings about the workflow, misleading the user and weakening review of changes to the package’s own CI.
Mechanism
The CLI appends a conditional note to the generated review request telling AI reviewers not to report or summarize specified workflow choices.
Attack narrative
When a PR changes a workflow that calls Yoke’s reusable review workflow, the CLI injects a note into the AI review request that directs reviewers to suppress findings about specified workflow choices and omit them from summaries. This can conceal defects in the workflow from users relying on the package’s review command.
AI rationale
The CLI contains a conditional reviewer-manipulation instruction that explicitly suppresses findings and summaries for selected workflow changes. This is a concrete review-integrity attack, even though the credential routing inspected is based on the configured provider endpoint.
Evidence
dist/cli.js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The review command runs AI reviewers on a PR and combines their findings.
- When a PR diff changes a workflow calling Yoke’s reusable review workflow, the CLI adds a special note to the review request.
- That note tells reviewers not to raise specified workflow choices as findings or mention them in summaries.
- The generated note is included in the request sent to the reviewers.
Evidence against
- Provider credentials are routed to endpoints derived from the configured provider base URL.
- The package exposes its behavior through a CLI command rather than an install hook.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli.jsView file
312// src/features/pr/raise.ts
L313: import { execFileSync } from "child_process";
L314:
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"litellm.baseUrl": setting("LiteLLM proxy URL"),
"litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
"foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
"foundry.apiKey": secret("Foundry API key. Env or --user config only"),
var settingsHelp = "\nEach setting falls back to its YOKE_* env var, then `yoke config set --user`; API keys come from env or config only. Run `yoke config` to see them all.";
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
"Repo-level config is not supported: it would put the API key in the repo. Pass --user to write the user-
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg2296async function claudeSignedIn() {
L2297: const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
L2298: if (!ok) return false;
...
L2307: try {
L2308: const response = await fetch(url, {
L2309: method: "POST",
L2310: headers: { "Content-Type": "application/json", ...headers },
L2311: body: JSON.stringify(body),
L2312: signal: AbortSignal.timeout(probeTimeout)
Findings
6 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.14.0.
See all versions of @makerx/yoke for other recorded verdicts.
- Avoid installing @makerx/yoke@0.14.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.