review-coderabbit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill runs gh pr view ... --jq '.reviews[] ... | .body' and gh api .../pulls/.../comments ... | .body, which ingests CodeRabbit-authored review/comment free text from the PR (outsider-authored content) into the agent’s LLM context at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill executes GitHub CLI calls at runtime (e.g., gh pr view --json reviews and gh api repos/{owner}/{repo}/pulls/$(gh pr view --json number -q .number)/comments, which query https://api.github.com/repos/{owner}/{repo}/pulls/.../comments) to fetch review/comment bodies that are then injected and used to drive subagents and prompts, so external content directly controls agent behavior.