coderabbit-core-workflow-b
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is to guide users in configuring CodeRabbit review parameters, including code guidelines, review tone, and noise reduction filters.
- [COMMAND_EXECUTION]: Step 6 includes a Bash script that utilizes the GitHub CLI (
gh api) to retrieve pull request comment counts. This is a standard automation task for developers and does not involve risky command injection or unauthorized access, as it targets official GitHub API endpoints. - [DATA_EXPOSURE]: The skill references standard configuration files (e.g.,
.eslintrc,.coderabbit.yaml,CLAUDE.md) but does not attempt to access sensitive credentials or private keys. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external data (GitHub PR comments) via a monitoring script. However, the script is restricted to counting comments from a specific bot user (
coderabbitai[bot]) and does not feed untrusted content into the agent's logic in a way that could cause behavior modification.
Audit Metadata