registry / @makerx/yoke / 0.15.0
@makerx/yoke@0.15.0
Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe scanner's credential and command-output findings resolve to the CLI's intended provider-backed PR review flow: credentials go to endpoints derived from the user's configured provider URL. The package exposes a command-line entry point and the review runs when requested; the only lifecycle script builds the package.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs yoke review, or configures and runs the separate CI workflow command.
Impact
PR review data is sent to the configured model provider as part of the requested review; no credential redirect or unrelated collector was found.
Mechanism
The CLI derives model endpoints from the configured provider base URL and passes its credential to the selected review harness.
AI rationale
The scanner's credential and command-output findings resolve to the CLI's intended provider-backed PR review flow: credentials go to endpoints derived from the user's configured provider URL. The package exposes a command-line entry point and the review runs when requested; the only lifecycle script builds the package.
Network endpoints3
login.microsoftonline.comcognitiveservices.azure.comuser-configured LiteLLM or Foundry base URL
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/cli.js as the yoke command; its only lifecycle script is prepublishOnly, which runs the build.
- LiteLLM and Foundry credentials are configured with a provider base URL; keys are limited to environment variables or user-level config.
- Provider endpoints are derived from the configured base URL, and the CLI passes the matching credential to the selected Claude or Codex harness.
- The review behavior is registered under the explicit yoke review command, which reviews a PR and combines reviewer findings.
Evidence against
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/cli.jsView file
312// src/features/pr/raise.ts
L313: import { execFileSync } from "child_process";
L314:
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"litellm.baseUrl": setting("LiteLLM proxy URL"),
"litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
"foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
"foundry.apiKey": secret("Foundry API key. Env or --user config only"),
var settingsHelp = "\nEach setting falls back to its YOKE_* env var, then `yoke config set --user`; API keys come from env or config only. Run `yoke config` to see them all.";
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
"Repo-level config is not supported: it would put the API key in the repo. Pass --user to write the user-
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg2296async function claudeSignedIn() {
L2297: const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
L2298: if (!ok) return false;
...
L2307: try {
L2308: const response = await fetch(url, {
L2309: method: "POST",
L2310: headers: { "Content-Type": "application/json", ...headers },
L2311: body: JSON.stringify(body),
L2312: signal: AbortSignal.timeout(probeTimeout)
Findings
5 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.15.0.
See all versions of @makerx/yoke for other recorded verdicts.
- Review the evidence and your use of @makerx/yoke@0.15.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.