yunxiao-devops

• Outcome: Review
• Latest audit: May 28, 2026 · 1:12 PM UTC
• Version: 2.5.0

Overview

The skill is broadly coherent as a Yunxiao DevOps helper, but it contains hardcoded account details and powerful repository-changing automation that require careful review before installation.

Review before installing. Remove or rotate the embedded Yunxiao token, replace fixed organization and Feishu recipient values with explicit user configuration, and avoid running the bug-fix, release, pipeline, or MR action flows with broad production tokens until repository allowlists, confirmation gates, and stop controls for background pollers are in place.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (128)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents capabilities to read environment variables and local files, invoke shell commands, and make network requests, but it does not declare permissions or boundaries for those actions. In an agent environment, this weakens policy enforcement and informed consent, making it easier for a broadly triggered skill to access secrets or perform side-effecting operations unexpectedly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose emphasizes Yunxiao DevOps integration, but the document also includes Feishu notification delivery, reading Feishu credentials from local config, log collection, and alerting workflows. This mismatch hides additional data flows and privileged behaviors from users and policy systems, increasing the chance of unintended credential use or outbound transmission of sensitive operational data.

Context-Inappropriate Capability

Medium

• Confidence: 73% confidence
• Finding: The documented Feishu task synchronization capability extends the skill beyond its stated Yunxiao DevOps scope into a separate third-party task system. Even if currently marked as postponed, including dormant cross-system write capability increases ambiguity about what the skill may do and can lead to overbroad permissions or accidental activation later.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The skill documents autonomous local code fixing using Claude Code, external model credentials, and SSH repository access, which goes well beyond passive DevOps integration. This materially increases risk because the skill can modify codebases, access private repositories, and send source context to an external model service using locally stored credentials.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document states the required permission is '代码管理/分支/读写' even though the API modifies AppStack environment-to-compute-resource bindings. This mismatch can cause users or automation to request, grant, or rely on the wrong privileges, leading to over-privileged access or failed access-control assumptions during a sensitive infrastructure operation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documentation title, description, and parameters describe an API for listing pipeline job execution history, but the actual request path points to getComponentsWithoutButtons, which appears to be a different endpoint. In a DevOps skill, this mismatch can cause the agent or operator to call the wrong API, leading to incorrect data retrieval, broken automation, and possible exposure of unintended pipeline metadata under a valid token.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script reads local Feishu credentials from ~/.openclaw/openclaw.json and sends interactive Feishu messages, which is an additional integration beyond direct Yunxiao/AppStack API interaction. This expands the skill's trust boundary to another platform and grants access to locally stored messaging secrets without clear disclosure or minimization, increasing the chance of credential misuse or unintended data exfiltration to Feishu.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The code spawns a detached local Python subprocess to poll workflow status, creating an unmanaged execution path outside the main Node.js process. Detached background execution makes behavior harder to audit, control, and terminate, and it introduces dependency on a local script plus inherited environment variables that may expose tokens or enable persistence-like behavior on the host.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script automatically generates a local SSH keypair and registers the public key against the Yunxiao organization, expanding repository access without an explicit, narrowly scoped user approval step. In a DevOps helper this is especially risky because it silently establishes persistent authentication that can outlive the immediate workflow and be reused for unintended repository access.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script invokes an external AI CLI with write access to a checked-out repository and uses bypassPermissions, allowing autonomous code modification based on bug text and repository contents. This creates a strong path for unsafe code changes, prompt-influenced behavior, and accidental insertion of insecure or malicious logic before human review catches it.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The callback handler accepts action values that synchronously launch other local scripts, including an unrelated bug-fix workflow, based on callback payload content. This expands the skill's effective capability beyond simple work-item creation and creates a trust-boundary issue: a user interaction in one flow can trigger additional local automation with inherited privileges and access to local secrets/configuration.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script reads Feishu app credentials from a local file in the user's home directory and uses them to obtain a tenant token, even though the skill is presented as Yunxiao DevOps functionality. Accessing unrelated local credentials increases the blast radius of the skill and creates an unexpected secret dependency that users may not realize is being consumed.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script reads Feishu app credentials from a local OpenClaw config file and uses them to obtain a tenant token for outbound messaging, even though the skill is presented primarily as a Yunxiao DevOps helper. This expands the skill's trust boundary to a second platform and accesses local secrets without clear disclosure, creating unnecessary credential exposure and cross-system message-sending capability.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file header describes generating a daily Yunxiao standup card, but the implementation also authenticates to Feishu and sends an outbound interactive message. That mismatch between documented purpose and actual capability is security-relevant because users may not expect the script to contact a third-party messaging platform or use stored credentials to deliver data externally.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The script reads local Feishu credentials from ~/.openclaw/openclaw.json and uses them to send messages to an external platform, even though the tool is presented as a Codeup MR operation utility. This creates an undeclared cross-system data flow and expands the trust boundary: repository IDs, MR metadata, branch names, titles, and action outcomes are exfiltrated to Feishu without explicit user consent or scope justification.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill description scopes the capability to Yunxiao/Codeup operations, but the implementation also authenticates to and sends interactive messages through Feishu. That mismatch is security-relevant because users invoking a DevOps skill would not reasonably expect it to access separate local credentials and communicate with a third-party messaging system.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script presents itself as an MR review list card, but it also exposes a callback path that can directly merge merge requests. This mismatch in declared behavior versus actual capability is dangerous because operators may invoke or deploy it assuming read-only behavior, while it can perform state-changing repository actions.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as interacting with Yunxiao, but this script also transmits pipeline status, commit metadata, and failure logs to Feishu. That expands the data boundary to a third-party messaging platform, which can leak sensitive operational data if users do not explicitly expect or approve that behavior.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The script reads Feishu application credentials from ~/.openclaw/openclaw.json even though the skill metadata emphasizes Yunxiao DevOps operations. Pulling unrelated messaging credentials from a user config broadens credential access beyond the apparent core function and can surprise operators reviewing the skill's declared scope.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script reads Feishu app credentials from a local OpenClaw config file even though the skill is presented as a Yunxiao DevOps integration. That expands the trust boundary to another integration and allows this skill to use unrelated local secrets to send messages, which is dangerous if the skill is over-privileged or compromised.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script launches a detached local Python subprocess in the background, creating behavior that persists outside the main execution flow and is not obvious from the skill description. Detached execution reduces visibility and control, and if the polled script or arguments are modified, it can become a persistence or abuse mechanism on the host.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script's stated purpose is Yunxiao sprint dashboard generation, but it also obtains Feishu credentials and sends or updates interactive Feishu messages. This expands the skill's data egress surface by transmitting project and sprint data to a second external service, which is security-relevant because users may not expect cross-platform messaging side effects from a dashboard script.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code reads Feishu app credentials from ~/.openclaw/openclaw.json even though the skill is described as a Yunxiao DevOps integration. Accessing unrelated local secrets increases privilege and creates an unnecessary secret-handling path that could be abused to message users or exfiltrate data through Feishu.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script reads Feishu app credentials from a local user config file and uses them to mint a tenant access token, even though its stated purpose is test-case management against Yunxiao. This expands the skill's privilege boundary to unrelated local secrets and creates a path for credential misuse or unintended exfiltration if the script is invoked in a broader agent context.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script goes beyond Yunxiao version management and silently uses locally stored Feishu app credentials to send interactive messages containing project and version information. This creates an additional data egress channel and expands the trust boundary: anyone invoking the script can cause organizational data to be pushed to Feishu without an explicit consent step or clear disclosure.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/appstack-card.mjs:307

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/bug-fix-flow.mjs:190

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/create-workitem-flow.mjs:344

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/release-flow.mjs:296

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/appstack-card.mjs:45

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/bug-fix-flow.mjs:390

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/commit-activity-card.mjs:25

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/create-workitem-flow.mjs:66

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/daily-standup-card.mjs:28

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/effort-checkin-card.mjs:27

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/mr-review-card.mjs:30

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/pipeline-log-card.mjs:24

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/release-flow.mjs:35

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/repo-init-flow.mjs:28

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/sprint-dashboard-card.mjs:29

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/testcase-card.mjs:23

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/version-release-flow.mjs:30

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/workitem-relation-flow.mjs:30

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/appstack-card.mjs:45

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/commit-activity-card.mjs:25

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/create-workitem-flow.mjs:66

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/daily-standup-card.mjs:28

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/effort-checkin-card.mjs:27

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/mr-review-card.mjs:30

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/pipeline-log-card.mjs:24

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/release-flow.mjs:35

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/repo-init-flow.mjs:28

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/sprint-dashboard-card.mjs:29

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/testcase-card.mjs:23

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/version-release-flow.mjs:30

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/workitem-relation-flow.mjs:30