coderabbit-observability

Pass

Audited by Gen Agent Trust Hub on Sep 12, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill provides legitimate observability functionality for tracking AI code review performance through official tools.
  • [COMMAND_EXECUTION]: Includes Bash scripts that execute the GitHub CLI (gh) to perform API queries for repository metrics. The use of variables and jq parsing aligns with standard developer workflows.
  • [EXTERNAL_DOWNLOADS]: Configures GitHub Action workflows using the actions/github-script@v7 action, which is an official and well-known resource from the GitHub organization.
  • [INDIRECT_PROMPT_INJECTION]: The skill interacts with external repository data during the metrics collection process.
  • Ingestion points: Pull request metadata, review states, and comment counts fetched from the GitHub API in SKILL.md.
  • Boundary markers: Not explicitly present in the data processing scripts, as the focus is on quantitative aggregation.
  • Capability inventory: Uses gh api for read-only data retrieval and core.summary for reporting in GitHub Actions.
  • Sanitization: Data is parsed as JSON and filtered using jq, which prevents raw external strings from being interpreted as instructions by the scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 12, 2026, 08:22 PM