coderabbit-resolver

SUSPICIOUS. The skill is broadly aligned with its PR-review purpose and uses expected GitHub/GraphQL workflows, with no visible credential theft or off-purpose exfiltration. The main concern is that it ingests untrusted PR/review content while retaining write/exec and merge authority, creating a meaningful indirect prompt-injection and autonomous-action risk; referenced local scripts could raise risk further but are not provided here.