coderabbit
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes review comments from an external source, which acts as an ingestion point for untrusted data.
- Ingestion points: SKILL.md (Step 2) uses CodeRabbit MCP to fetch external PR comments into the agent context.
- Boundary markers: The instructions lack clear delimiters or warnings to treat external comments strictly as data, which could lead the agent to follow instructions embedded within a review comment.
- Capability inventory: SKILL.md (Steps 4 and 6) grants the agent permissions to modify the file system ("Apply fixes") and execute shell commands (
pnpm lint:fix,pnpm lint,git commit). - Sanitization: No sanitization, validation, or filtering of the fetched comment content is specified before the agent acts upon it.
Audit Metadata