coderabbit-fix

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The skill fetches PR comment bodies from the Bitbucket Cloud API (/pullrequests/{id}/comments), and those outsider-authored free-text comment content.raw fields are parsed and then injected into the agent’s LLM context via the generated JSON (findings[].body, title, suggestion) that the agent reads in Step 1/2/4.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill makes runtime requests to the Bitbucket API (e.g. https://api.bitbucket.org/2.0/repositories/{workspace}/{repo}/pullrequests/{prId}/comments) and uses fetched comment bodies/suggestion blocks to drive fixes/edits, so remote content directly controls the agent's actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt instructs modifying the Codex sandbox config (~/.codex/config.toml) to enable network and include secret env vars and even suggests running codex with --sandbox danger-full-access on macOS, which deliberately weakens/bypasses sandbox protections and exposes credentials — a host-state and security compromise.