coderabbit-migration-deep-dive
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs expected operations for a migration tool, focusing on repository configuration management and metrics gathering. It does not contain obfuscation, credential harvesting, or unauthorized network exfiltration.- [COMMAND_EXECUTION]: The bash scripts utilize the GitHub CLI (
gh) to list organization installations, repository configurations, and pull request data. These operations are performed within the context of the user's authenticated environment and are consistent with the documented purpose of assessing and managing review tools.- [EXTERNAL_DOWNLOADS]: References to external resources are limited to official documentation and comparison pages oncoderabbit.ai, which is a well-known service related to the skill's purpose.- [INDIRECT_PROMPT_INJECTION]: The skill reads repository names and PR metadata from GitHub. While this data is interpolated into subsequent commands and output, the risk is minimal as the script primarily performs read-only discovery and displays metrics to the user without executing high-privilege actions based on that external data.
Audit Metadata