ClawHub
Back to skill

Security audit

Azure DevOps 基础版

Security checks for vulnerabilities and agentic risk

Overview

This Azure DevOps skill fits its general purpose, but it can use a PAT to make live repository changes and has misleading or overbroad instructions.

Install only if you intend to let an agent access Azure DevOps with your PAT. Use the narrowest PAT scopes possible, review target organization/project/repository/branches before any PR creation, and do not rely on the skill's local-only privacy claim because it sends authenticated requests to Azure DevOps.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The document claims data is stored locally and not uploaded to the cloud, while the skill explicitly instructs sending authenticated requests to Azure DevOps over the network. This is dangerous because it gives users false assurances about data handling and may cause them to expose repository metadata, PR content, or tokens under incorrect privacy assumptions.

Vague Triggers

High
Confidence
89% confidence
Finding
The skill metadata and description are broad enough to overlap with generic development, debugging, and deployment requests, increasing the chance that an agent activates it outside its intended Azure DevOps scope. In a tool with exec and write capabilities plus remote API actions, overbroad triggering can lead to unintended repository enumeration or state-changing operations in the wrong context.

Vague Triggers

High
Confidence
94% confidence
Finding
The '触发条件' section says to use the skill for data analysis, reporting, statistics, and visualization, which does not match the actual Azure DevOps repo/PR functionality. This ambiguity increases accidental invocation risk and can cause an agent to run a networked, state-capable skill for unrelated requests.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill includes creation of pull requests, which changes remote system state, but it does not require explicit user confirmation, dry-run behavior, or a clear risk notice before execution. In an agent setting, this can cause unauthorized or unintended changes to repositories, noisy PR spam, information disclosure in PR descriptions, or workflow disruption if triggered by ambiguous user input.

Static analysis

No suspicious patterns detected.