coderabbit-observability
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate observability functionality for tracking AI code review performance through official tools.
- [COMMAND_EXECUTION]: Includes Bash scripts that execute the GitHub CLI (
gh) to perform API queries for repository metrics. The use of variables andjqparsing aligns with standard developer workflows. - [EXTERNAL_DOWNLOADS]: Configures GitHub Action workflows using the
actions/github-script@v7action, which is an official and well-known resource from the GitHub organization. - [INDIRECT_PROMPT_INJECTION]: The skill interacts with external repository data during the metrics collection process.
- Ingestion points: Pull request metadata, review states, and comment counts fetched from the GitHub API in SKILL.md.
- Boundary markers: Not explicitly present in the data processing scripts, as the focus is on quantitative aggregation.
- Capability inventory: Uses
gh apifor read-only data retrieval andcore.summaryfor reporting in GitHub Actions. - Sanitization: Data is parsed as JSON and filtered using
jq, which prevents raw external strings from being interpreted as instructions by the scripts.
Audit Metadata