Azure DevOps

List Azure DevOps projects, repositories, and branches; create pull requests; manage work items; check build status. Use when working with Azure DevOps resources, checking PR status, querying project structure, or automating DevOps workflows.

Security Scan

The skill's Azure DevOps commands are coherent, but the runtime instructions ask the agent to persist secrets and reference an undeclared config/env variable — the metadata and SKILL.md do not fully align.

Purpose & Capability

Name and description match the contained curl/jq commands for listing projects/repos/branches, creating PRs, and checking build/PR status. Requested binaries (curl, jq) are appropriate for the described work.

Instruction Scope

SKILL.md instructs the agent to read and write ~/.openclaw/openclaw.json (store the PAT and AZURE_DEVOPS_ORG) and to prompt the user for missing values. That is persistent storage of a secret and is not declared in the registry metadata; the instructions also require AZURE_DEVOPS_ORG though it is not listed as a required env var in the skill metadata.

Install Mechanism

Instruction-only skill with no install spec or downloads. Lowest install risk — nothing is written to disk by an installer other than what the agent is asked to do at runtime.

Credentials

Metadata declares only AZURE_DEVOPS_PAT as required, but SKILL.md also requires AZURE_DEVOPS_ORG. The skill directs storing AZURE_DEVOPS_PAT to disk for persistent use; storing a PAT is sensitive and should be justified and documented (scopes, storage protection). No unrelated credentials requested.

Persistence & Privilege

The skill asks to write entries into ~/.openclaw/openclaw.json (its own agent config). Writing to its own config is a normal install-time behavior, but because this involves persisting a secret (PAT) the skill should have declared this config path and explained storage/permissions. always:false and normal invocation are appropriate.

What to consider before installing

This skill appears to do what it says (call Azure DevOps REST APIs via curl), but there are a few mismatches and privacy concerns you should consider before installing: - Metadata vs instructions: The registry only lists AZURE_DEVOPS_PAT, but the SKILL.md also requires AZURE_DEVOPS_ORG and instructs writing both into ~/.openclaw/openclaw.json. Confirm the skill metadata is updated to declare AZURE_DEVOPS_ORG and the config path. - Secret persistence: The skill asks to store your Personal Access Token on disk. Prefer using a PAT with the minimum required scopes, ensure the file (~/.openclaw/openclaw.json) has strict filesystem permissions, or provide the PAT via environment variable at runtime instead of persistent storage. - Unknown source: The skill source/homepage is unknown. Consider whether you trust this package before giving it long-lived credentials. - Safer alternatives: If you only need occasional commands, prefer supplying AZURE_DEVOPS_PAT and AZURE_DEVOPS_ORG as ephemeral environment variables for the session instead of storing them. If you proceed, review the contents and permissions of ~/.openclaw/openclaw.json after the skill stores credentials. If you want, I can suggest safer wording for the SKILL.md (declare the AZURE_DEVOPS_ORG env, explicitly require/configure the config path, and note recommended PAT scopes and file-permission guidance).

Azure DevOps Skill

List projects, repositories, branches. Create pull requests. Manage work items. Check build status.

Check before running for valid Configuration, if values missing ask the user!

Required:

• AZURE_DEVOPS_PAT: Personal Access Token
• AZURE_DEVOPS_ORG: Organization name

If values are missing from ~/.openclaw/openclaw.json, the agent should:

1. ASK the user for the missing PAT and/or organization name
2. Store them in ~/.openclaw/openclaw.json under skills.entries["azure-devops"]

Example Config

{
  skills: {
    entries: {
      "azure-devops": {
        apiKey: "YOUR_PERSONAL_ACCESS_TOKEN",  // AZURE_DEVOPS_PAT
        env: {
          AZURE_DEVOPS_ORG: "YourOrganizationName"
        }
      }
    }
  }
}

Commands

List Projects

curl -s -u ":${AZURE_DEVOPS_PAT}" \
  "https://dev.azure.com/${AZURE_DEVOPS_ORG}/_apis/projects?api-version=7.1" \
  | jq -r '.value[] | "\(.name) - \(.description // "No description")"'

List Repositories in a Project

PROJECT="YourProject"
curl -s -u ":${AZURE_DEVOPS_PAT}" \
  "https://dev.azure.com/${AZURE_DEVOPS_ORG}/${PROJECT}/_apis/git/repositories?api-version=7.1" \
  | jq -r '.value[] | "\(.name) - \(.webUrl)"'

List Branches in a Repository

PROJECT="YourProject"
REPO="YourRepo"
curl -s -u ":${AZURE_DEVOPS_PAT}" \
  "https://dev.azure.com/${AZURE_DEVOPS_ORG}/${PROJECT}/_apis/git/repositories/${REPO}/refs?filter=heads/&api-version=7.1" \
  | jq -r '.value[] | .name | sub("refs/heads/"; "")'

Create a Pull Request

PROJECT="YourProject"
REPO_ID="repo-id-here"
SOURCE_BRANCH="feature/my-branch"
TARGET_BRANCH="main"
TITLE="PR Title"
DESCRIPTION="PR Description"

curl -s -u ":${AZURE_DEVOPS_PAT}" \
  -H "Content-Type: application/json" \
  -X POST \
  -d '{
    "sourceRefName": "refs/heads/'"${SOURCE_BRANCH}"'",
    "targetRefName": "refs/heads/'"${TARGET_BRANCH}"'",
    "title": "'"${TITLE}"'",
    "description": "'"${DESCRIPTION}"'"
  }' \
  "https://dev.azure.com/${AZURE_DEVOPS_ORG}/${PROJECT}/_apis/git/repositories/${REPO_ID}/pullrequests?api-version=7.1"

Get Repository ID

PROJECT="YourProject"
REPO_NAME="YourRepo"
curl -s -u ":${AZURE_DEVOPS_PAT}" \
  "https://dev.azure.com/${AZURE_DEVOPS_ORG}/${PROJECT}/_apis/git/repositories/${REPO_NAME}?api-version=7.1" \
  | jq -r '.id'

List Pull Requests

PROJECT="YourProject"
REPO_ID="repo-id"
curl -s -u ":${AZURE_DEVOPS_PAT}" \
  "https://dev.azure.com/${AZURE_DEVOPS_ORG}/${PROJECT}/_apis/git/repositories/${REPO_ID}/pullrequests?api-version=7.1" \
  | jq -r '.value[] | "#\(.pullRequestId): \(.title) [\(.sourceRefName | sub("refs/heads/"; ""))] -> [\(.targetRefName | sub("refs/heads/"; ""))] - \(.createdBy.displayName)"'

Notes

• Base URL: https://dev.azure.com/${AZURE_DEVOPS_ORG}
• API Version: 7.1
• Auth: Basic Auth with empty username and PAT as password
• Never log or expose the PAT in responses
• Documentation: https://learn.microsoft.com/en-us/rest/api/azure/devops/