yunxiao-devops

• Analyzed: May 10, 2026, 6:29 AM
• Findings: 1
• Version: 2.5.0
• Hash: 8b7aad6c3d9e82199aa6388d58bcfdebadd1f10b38cc19b0382f8cb05a482382
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive suite for Alibaba Yunxiao DevOps automation but contains a hardcoded Personal Access Token (PAT) and Feishu OpenID in `scripts/mr-action.mjs`, which is a major security vulnerability. Additionally, `scripts/bug-fix-flow.mjs` performs high-risk operations including automated SSH key generation, registration of the public key to the Yunxiao platform, and the execution of AI-generated code via Claude Code. While these features are aligned with the stated purpose and include some safeguards (such as privilege dropping to a non-root user), the combination of leaked credentials and broad system/repository access warrants a suspicious classification.