registry / @makerx/yoke / 0.8.0
@makerx/yoke@0.8.0
Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package is a user-invoked CLI, with no install hook or import-time attack behavior identified. Its process, network, and skill-file operations serve its documented review and synchronization commands.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs a yoke CLI command; review and skill synchronization are not triggered by package installation or import.
Impact
These commands can access the user’s configured review provider and create or update yoke-owned skill files at the selected location.
Mechanism
Review runs configured Claude/Codex CLIs and sends a minimal ping to a configured provider endpoint. The sync command writes the package’s bundled skill instructions to .claude/skills locations.
AI rationale
The package is a user-invoked CLI, with no install hook or import-time attack behavior identified. Its process, network, and skill-file operations serve its documented review and synchronization commands.
Evidence
dist/cli.js<repo>/.claude/skills/*/SKILL.md~/.claude/skills/review-ci/SKILL.md
Network endpoints2
User-configured model provider base URLGitHub CLI endpoints used by explicit PR commands
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest describes the package as user-invoked CLI skills and exposes dist/cli.js as a command, with no install hook.
- The review workflow writes a request file and invokes configured Claude/Codex reviewers when the user runs the review command.
- Provider probes POST a small ping request to the configured provider endpoint.
- The sync command writes bundled skill files under the repository’s .claude/skills or the user’s ~/.claude/skills; it is not run automatically.
Evidence against
- The CLI performs shell execution, network requests, and writes AI-agent skill configuration, but those actions are tied to explicit commands.
- No automatic credential collection or transmission to an unrelated host was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flaggeddist/cli.jsView file
285// src/features/pr/raise.ts
L286: import { execFileSync } from "child_process";
L287:
High
1769async function claudeSignedIn() {
L1770: const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
L1771: if (!ok) return false;
...
L1780: try {
L1781: const response = await fetch(url, {
L1782: method: "POST",
L1783: headers: { "Content-Type": "application/json", ...headers },
L1784: body: JSON.stringify(body),
L1785: signal: AbortSignal.timeout(probeTimeout)
High
Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/cli.jsView on unpkg · L1769•Runtime or CLI code links a write operation to an explicit external AI-agent control path:
telling the user to commit and push the workflow file.
if \`yoke\` is not found, run \`npm i -g @makerx/yoke\` and retry.
`
};
var reviewskill = {
name: "review",
description: "adversarially review a pr with claude and codex, then combine their findings.",
disablemodelinvocation: true,
body: `
run \`yoke review $arguments\` in the foreground, not as a background task, with the longest timeout your shell tool allows, so the user sees each reviewer's progress as it streams; two reviewers and a synthesis pass take several minutes. then relay the findings it printed. do not add findings of your own or re-review the code. each reviewer's tool calls go to \`review.
Findings
5 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCommand Output Exfiltrationdist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.8.0.
See all versions of @makerx/yoke for other recorded verdicts.
- Review the evidence and your use of @makerx/yoke@0.8.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.