coderabbit-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides configuration templates for
.coderabbit.yamlthat implement security best practices, such as excluding sensitive file patterns (e.g.,.env,.pem,credentials) from AI review processing. - [SAFE]: Includes a GitHub Actions workflow snippet for secret scanning that uses standard regex patterns to identify potentially leaked credentials in pull request diffs using
grep. - [SAFE]: Contains a local audit script written in Bash and Python that performs a static check of the
.coderabbit.yamlfile. The Python snippet correctly usesyaml.safe_load()to parse the configuration, which is a secure practice to prevent arbitrary code execution during deserialization. - [SAFE]: The instructions promote security hardening by suggesting specific review criteria for sensitive paths such as authentication logic, database queries, and CI/CD pipelines (e.g., pinning actions to SHA hashes).
Audit Metadata