registry / @makerx/yoke / 0.16.0
@makerx/yoke@0.16.0
Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe source uses subprocesses, provider requests, and credential handling as part of the CLI's review workflow. Credentials are routed through configured provider settings, and the Microsoft endpoint flow is a documented Foundry/GitHub OIDC token exchange; no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.
Trigger
The user invokes a `yoke` command, such as the review command.
Impact
No unauthorized credential transfer or other malicious impact was identified.
Mechanism
The CLI passes provider credentials to the configured provider endpoint; its Foundry CI flow can exchange GitHub OIDC for an Azure token.
AI rationale
The source uses subprocesses, provider requests, and credential handling as part of the CLI's review workflow. Credentials are routed through configured provider settings, and the Microsoft endpoint flow is a documented Foundry/GitHub OIDC token exchange; no malicious behavior was identified.
Evidence
User-configured review output and configuration paths
Network endpoints3
login.microsoftonline.comcognitiveservices.azure.comuser-configured provider base URL
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes `dist/cli.js` as its `yoke` command and has only a `prepublishOnly` build script; no install hook is declared.
- Provider credentials are passed to the configured provider URL for Claude or Codex use.
- Foundry GitHub OIDC credentials are exchanged with Microsoft Entra for an Azure Cognitive Services token.
- The review command runs when explicitly invoked by the user.
Evidence against
- The CLI uses subprocesses and network requests, but these support its documented review and model-provider functions.
- The flagged Anthropic credential redirect is not a fixed unofficial gateway: the provider base URL comes from configuration.
- No automatic credential collection or unrelated credential destination was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/cli.jsView file
312// src/features/pr/raise.ts
L313: import { execFileSync } from "child_process";
L314:
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"litellm.baseUrl": setting("LiteLLM proxy URL"),
"litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
"foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
"foundry.apiKey": secret("Foundry API key. Env or --user config only"),
var settingsHelp = "\nEach setting falls back to its YOKE_* env var, then `yoke config set --user`; API keys come from env or config only. Run `yoke config` to see them all.";
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
"Repo-level config is not supported: it would put the API key in the repo. Pass --user to write the user-
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg2296async function claudeSignedIn() {
L2297: const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
L2298: if (!ok) return false;
...
L2307: try {
L2308: const response = await fetch(url, {
L2309: method: "POST",
L2310: headers: { "Content-Type": "application/json", ...headers },
L2311: body: JSON.stringify(body),
L2312: signal: AbortSignal.timeout(probeTimeout)
Findings
5 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.16.0.
See all versions of @makerx/yoke for other recorded verdicts.
- Review the evidence and your use of @makerx/yoke@0.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.