Azure Devops MCP Replacement For OpenClaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:25 AM UTC
• Version: 1.0.1

Overview

This Azure DevOps skill is mostly purpose-aligned, but it asks for sensitive organization access and includes write actions and people-tracking features that are not consistently scoped or disclosed.

Install only if you are comfortable giving the skill an Azure DevOps PAT that can read broad organization data and, depending on scopes, modify work items and wiki pages. Prefer the narrowest PAT scopes that match your intended use, avoid automatic use on vague Azure DevOps mentions, review any create/update action before it runs, and protect team-config.json because it can contain employee emails and workload capacity data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Credential Access

High

• Category: Privilege Escalation

Content

- Node.js 18+
- An Azure DevOps organization
- A Personal Access Token (PAT)

## Setup

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Node.js 18+
- An Azure DevOps organization
- A Personal Access Token (PAT)

## Setup

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The manifest and documentation overstate the skill's capabilities, including broad Azure DevOps coverage and mutation support, while the observed implementation appears narrower. This mismatch can mislead operators and downstream agents into authorizing broader access or trusting operations the code does not actually perform, which is a security and governance risk in tool-driven environments.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The manifest and documentation overstate the skill's capabilities, including broad Azure DevOps coverage and mutation support, while the observed implementation appears narrower. This mismatch can mislead operators and downstream agents into authorizing broader access or trusting operations the code does not actually perform, which is a security and governance risk in tool-driven environments.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The manifest and documentation overstate the skill's capabilities, including broad Azure DevOps coverage and mutation support, while the observed implementation appears narrower. This mismatch can mislead operators and downstream agents into authorizing broader access or trusting operations the code does not actually perform, which is a security and governance risk in tool-driven environments.

Credential Access

High

• Category: Privilege Escalation

Content

### Required PAT scopes

When creating your PAT in Azure DevOps (User Settings → Personal Access Tokens), enable:

| PAT scope label | Covers |
|---|---|

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documentation advertises creating and updating work items and writing wiki pages, which are actions that affect user or organizational data in a remote system. The README provides examples and setup instructions but does not include a user-facing warning that these operations may change Azure DevOps content.

Session Persistence

Medium

• Category: Rogue Agent

Content

- 🗂️ **Work Items** — list, get, create, update, query via WIQL, view current sprint
- 🔀 **Repos & PRs** — list repos, get repo details, browse pull requests
- 🚀 **Pipelines & Builds** — list pipelines, view runs, inspect builds
- 📖 **Wikis** — list wikis, read and write pages
- 🧪 **Test Plans** — list test plans and suites

## Requirements

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares access to sensitive environment variables, including an Azure DevOps PAT, but does not declare an explicit tool/permission scope limiting what tools may be used. In an agent setting, missing scope boundaries increases the chance the skill is invoked with broader capabilities than intended, enabling credential exposure or unintended actions against Azure DevOps.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation text is extremely broad and instructs use whenever many common Azure DevOps-related terms appear. Over-broad triggering can cause the agent to invoke the skill unnecessarily in contexts involving sensitive org data or credentials, increasing the chance of unintended API access or overcollection.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The security/privacy section states that no data is written to disk and frames the behavior as only outbound HTTPS calls, yet the documented workflow also reads a local configuration file containing personal information. Misstating data handling weakens trust boundaries and may cause users to expose employee data without understanding the local privacy implications.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill introduces local people-tracking and capacity-analysis behavior driven by team-config.json, but that handling of personal data is not reflected in the high-level manifest description. Hidden or under-disclosed processing of employee emails and workload data can cause privacy, compliance, and consent issues, especially when users believe the skill only talks to Azure DevOps.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation instructs users to store team member emails and capacity data in a local file but does not include an explicit privacy warning or data-handling guidance. This can lead to unnecessary retention of personally identifiable information and workload metadata without informed consent or safeguards.

Static analysis

No suspicious patterns detected.