registry / @makerx/yoke / 0.4.1
@makerx/yoke@0.4.1
⚠ Under reviewLean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
Static Scan Results
scanned 10d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
1 flaggeddist/cli.jsView file
•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
r";
}
violations;
};
var rungh = (args) => execfilesync("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
function raisepr({ title, body, base, draft }, run = rungh) {
const violations = validatepr(title, body);
if (violations.length) throw new prvalidationerror(violations);
const args = ["pr", "create", "--title", title.trim(), "--body", body.trim()];
if (base) args.push("--base", base);
if (draft) args.push("--draft");
const output = run(args).trim().split("\n");
return output.at(-1) ?? "";
}
import { existssync, mkdirsync, readfilesync, writefilesync } from "fs";
import { homedir } from "os";
import { join } from "path";
High
External Ai Agent Control Surface Mutation
Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.
dist/cli.jsView on unpkgFindings
1 High5 Low
HighExternal Ai Agent Control Surface Mutationdist/cli.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.4.1.
See all versions of @makerx/yoke for other recorded verdicts.
- Review the evidence and your use of @makerx/yoke@0.4.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.