semgrep-coderabbit-review
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'opencode-semgrep-coderabbit-plugin' and third-party tools 'semgrep' and 'coderabbit' to function. The plugin is a resource provided by the author 'acedergren'.
- [COMMAND_EXECUTION]: The skill instructions specify the execution of CLI tools 'semgrep' and 'coderabbit' to perform automated code analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes external code files, creating a potential surface for indirect prompt injection if the files contain malicious instructions.
- Ingestion points: Local source code and uncommitted git changes.
- Boundary markers: None provided in the skill instructions to delimit untrusted data from the agent context.
- Capability inventory: Execution of 'semgrep' and 'coderabbit' shell commands.
- Sanitization: No validation or sanitization of the reviewed code content is specified.
Audit Metadata