registry / @makerx/yoke / 0.9.0
@makerx/yoke@0.9.0
Lean, user-invoked Claude Code skills for MakerX AI-assisted delivery, plus the CLI they call.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe flagged credential and process flows belong to the package's review CLI: provider credentials are directed to the configured provider base URL, and the CLI launches the selected review harness when invoked. Skill writes and CI setup are explicit commands; the manifest declares no install hook.
Static reason
One or more suspicious static signals were detected.
Trigger
Running the yoke CLI commands, such as review or sync; review-ci and config set also require explicit commands.
Impact
Expected review requests send review inputs to the selected harness or configured provider. Explicit sync writes skill files; no unrequested credential transfer or broader agent-setting change was identified.
Mechanism
Review runs the selected Claude or Codex harness and uses configured provider endpoints. GitHub OIDC and Entra token exchange are used for the configured CI authentication path. The sync command writes the package's skills into the selected .claude/skills directory.
AI rationale
The flagged credential and process flows belong to the package's review CLI: provider credentials are directed to the configured provider base URL, and the CLI launches the selected review harness when invoked. Skill writes and CI setup are explicit commands; the manifest declares no install hook.
Evidence
<cwd>/.claude/skills/<skill>/SKILL.md~/.claude/skills/<skill>/SKILL.md${XDG_CACHE_HOME:-~/.cache}/yoke/reviews/<owner>/<repo>/<run>/
Network endpoints4
ACTIONS_ID_TOKEN_REQUEST_URL (provided by the GitHub Actions environment)login.microsoftonline.com/{tenantId}/oauth2/v2.0/token${configured baseUrl}/anthropic/v1/messages${configured baseUrl}/openai/v1/responses
Decision evidence
public snapshotAI called this Clean at 95.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI and has only a prepublishOnly build hook; no install hook is declared.
- Provider endpoints are derived from the configured base URL, and provider credentials are passed to that endpoint.
- The CLI launches Claude or Codex as a review harness; review starts from an explicit CLI action.
- Writing skills under .claude/skills is performed by the explicit sync command.
Evidence against
- The flagged Azure and Microsoft URLs are used for GitHub OIDC and Entra token exchange, not as a fixed credential collection gateway.
- The source does not establish automatic command-output exfiltration or agent configuration mutation.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli.jsView file
290// src/features/pr/raise.ts
L291: import { execFileSync } from "child_process";
L292:
High
•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/cli.js:
"litellm.baseUrl": setting("LiteLLM proxy URL"),
"litellm.apiKey": secret("LiteLLM API key. Env or --user config only"),
"foundry.baseUrl": setting("https://<resource>.services.ai.azure.com"),
"foundry.apiKey": secret("Foundry API key. Env or --user config only"),
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
"Repo-level config is not supported: it would put the API key in the repo. Pass --user to write the user-level yoke config."
writeFileSync(path, `${JSON.stringify(file, null, 2)}
import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileS
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/cli.jsView on unpkg1948async function claudeSignedIn() {
L1949: const { ok, stdout } = await exec("claude", ["auth", "status", "--json"]);
L1950: if (!ok) return false;
...
L1959: try {
L1960: const response = await fetch(url, {
L1961: method: "POST",
L1962: headers: { "Content-Type": "application/json", ...headers },
L1963: body: JSON.stringify(body),
L1964: signal: AbortSignal.timeout(probeTimeout)
Findings
6 High2 Medium5 Low
HighChild Processdist/cli.js
HighShell
HighCredential Redirect Persistencedist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighExternal Ai Agent Control Surface Mutationdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @makerx/yoke@0.9.0.
See all versions of @makerx/yoke for other recorded verdicts.
- Review the evidence and your use of @makerx/yoke@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.