coderabbit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's autofix flow (described in SKILL.md and references/coderabbit-docs/cli-skills.md) explicitly tells the agent to fetch unresolved CodeRabbit review threads from pull requests using GitHub CLI / gh api and to extract agent-ready fix prompts from those user-generated PR comments and apply fixes, meaning it ingests untrusted, third-party content that directly drives tool actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill repeatedly instructs installing and executing a remote installer script fetched from https://cli.coderabbit.ai/install.sh (e.g., "curl -fsSL https://cli.coderabbit.ai/install.sh | sh"), which downloads and runs remote code at runtime and is presented as a required dependency for the skill.