ClawHub
Back to skill

Security audit

Azure DevOps 专业版

Security checks for vulnerabilities and agentic risk

Overview

This Azure DevOps skill is mostly purpose-aligned, but it asks for broad read/write/command authority and describes automatic/batch DevOps actions without strong scoping or confirmation controls.

Review before installing. Use only with narrowly scoped Azure DevOps PATs, avoid organization-wide permissions unless required, and require the agent to show the target organization/project/repository plus a dry-run summary before creating PRs, changing work items, running batch jobs, or sending webhook/callback notifications.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation description is broad enough to match ordinary project-management requests, which can cause the agent to activate this skill in contexts where the user did not intend Azure DevOps actions. Because the skill has write and exec capabilities, accidental invocation could lead to unintended repository, work-item, or pipeline modifications.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The sample trigger phrase '请帮我个人项目快速浏览' is too generic and could match many non-DevOps requests. In an agent environment, vague activation phrases increase the chance of misrouting a conversation into a high-privilege skill that can read, write, and execute commands.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises read, write, and exec tools and includes bulk PR/work-item operations, but it does not present a strong upfront warning that use may modify repositories, work items, permissions, or trigger external API actions. In practice this can cause users or upstream agents to invoke destructive or wide-scope changes without informed consent, especially in batch mode.

Static analysis

No suspicious patterns detected.