get-qodo-rules
Warn
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill retrieves an
API_KEYfrom the local configuration file~/.qodo/config.json. - [DATA_EXFILTRATION]: The skill transmits the
API_KEYto theqodo.aidomain. While this is the intended functionality for the Qodo integration, the transmission of local secrets to a remote endpoint is a sensitive operation. - [PROMPT_INJECTION]: The skill instructs the agent to treat externally fetched "rules" as non-negotiable and mandatory ("Must comply"). This creates a surface for indirect prompt injection where a compromised or malicious API response could hijack agent behavior.
- [EXTERNAL_DOWNLOADS]: The skill performs HTTP GET requests to
qodo-platform.{ENVIRONMENT_NAME}.qodo.aito retrieve rules and configuration data.
Audit Metadata