skills/jeremylongshore/tons-of-skills-marketplace/coderabbit-migration-deep-dive/Gen Agent Trust Hub
coderabbit-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (gh) to perform diagnostic and reporting tasks, such as listing repository installations and checking for the presence of specific configuration files (e.g., .codacy.yml, .deepsource.toml). These operations are restricted to the user's authorized organizations and are consistent with the documented purpose of migrating code review tools.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitHub APIs, including organization installation lists, repository names, and file existence metadata. While this represents a data ingestion surface, the risk is negligible as the skill only processes this information to display summary reports or calculate adoption metrics. 1. Ingestion points: GitHub API responses for installations, repository lists, and content metadata. 2. Boundary markers: Absent, but processing is limited to specific JSON fields. 3. Capability inventory: gh api tool usage. 4. Sanitization: Employs jq filters to extract specific, expected fields from the API responses.
Audit Metadata