📦
История аудитов
autofix - 4 аудиты
Сравнение версий
Изменения возможностей и находок между проверенными версиями, сначала новые.
| Версия | Дата | Результат | Пункты проверки | Изменение к предыдущей |
|---|---|---|---|---|
| v4 Последняя | 2026年7月6日 07:14 | 1 подтверждено | 8 | Возможности не изменились |
| v3 | 2026年7月6日 07:14 | 1 подтверждено | 8 | Доступ к сетиДоступ к файловой системе |
| v2 | 2026年6月29日 00:11 | Подтверждённых находок нет | 5 | Доступ к сетиДоступ к файловой системе |
| v1 | 2026年3月25日 08:01 | Подтверждённых находок нет | 1 | Базовая |
Версия аудита 4 Последняя
2026年7月6日 07:14
Most static findings are Markdown code spans or code fences and are false positives for Ruby backtick execution. The real risks are bounded GitHub and Git shell commands. A high-impact semantic issue also executes external CodeRabbit comment prompts as direct agent instructions.
2
Просканировано файлов
332
Проанализировано строк
10
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (1)
Высокий
Untrusted PR Comment Prompt Execution
The skill extracts CodeRabbit comment text from GitHub and tells the agent to execute the agent prompt as a direct instruction, including in auto-fix mode. PR comments are external content, so this can turn malicious or compromised review text into agent instructions that edit files or influence later commands.
The workflow explicitly treats fetched GitHub comment body content as the fix prompt and says to execute it literally. The cited auto-fix path applies changes without per-issue approval, making prompt injection impact credible.
Пункты проверки возможностей (8)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Средний
Shell command substitution · 2 совпадений
gh pr list --head $(git branch --show-current) --state open --json number,title
This is a real Bash command that runs git inside a GitHub CLI command. The branch value is unquoted, so unusual branch names could cause argument parsing issues even though arbitrary command injection is unlikely.
Средний
Shell command substitution · 2 совпадений
gh pr comment <pr-number> --body "$(cat <<'EOF'
This command posts generated content to GitHub through gh pr comment. The heredoc limits shell expansion inside the body, but it still performs a remote write from skill-controlled workflow output.
Средний
Ruby/shell backtick execution
- Ask: "Push now?" → If yes: `git push`, inform "CodeRabbit will review in ~5 min", EXIT skill
The workflow can run git push, which publishes local commits to the remote repository. The skill asks for user confirmation first, so the risk is bounded but still a real repository mutation.
Средний
Ruby/shell backtick execution
- Ask: "Push changes?" → If yes: `git push`
The workflow can run git push after fixes are committed. It is user-confirmed, but it still publishes changes to the remote repository and should remain explicit.
Средний
Template literal with command substitution · 2 совпадений
```bash
The fenced Bash block contains a GitHub CLI command with command substitution for the current branch. This is legitimate workflow automation, but it should quote the branch value before execution.
Факторы риска
⚙️ Внешние команды (37)
github.md:67-68 github.md:68-70 github.md:70-72 github.md:72-76 github.md:17 github.md:61-64 SKILL.md:28 SKILL.md:29 SKILL.md:31 SKILL.md:36 SKILL.md:40 SKILL.md:42 SKILL.md:49 SKILL.md:57 SKILL.md:63-65 SKILL.md:65-72 SKILL.md:72-75 SKILL.md:75-76 SKILL.md:76 SKILL.md:88-90 SKILL.md:90-103 SKILL.md:103-110 SKILL.md:110-158 SKILL.md:158-167 SKILL.md:167-170 SKILL.md:170-178 SKILL.md:178-184 SKILL.md:184-192 SKILL.md:192-199 SKILL.md:199-200 SKILL.md:200-202 SKILL.md:202-204 SKILL.md:204-208 SKILL.md:64 SKILL.md:193-196 SKILL.md:63-65 SKILL.md:192-199
Аудитор:: codex
2026年7月6日 07:14
Most static findings are Markdown code spans or code fences and are false positives for Ruby backtick execution. The real risks are bounded GitHub and Git shell commands. A high-impact semantic issue also executes external CodeRabbit comment prompts as direct agent instructions.
2
Просканировано файлов
332
Проанализировано строк
10
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (1)
Высокий
Untrusted PR Comment Prompt Execution
The skill extracts CodeRabbit comment text from GitHub and tells the agent to execute the agent prompt as a direct instruction, including in auto-fix mode. PR comments are external content, so this can turn malicious or compromised review text into agent instructions that edit files or influence later commands.
The workflow explicitly treats fetched GitHub comment body content as the fix prompt and says to execute it literally. The cited auto-fix path applies changes without per-issue approval, making prompt injection impact credible.
Пункты проверки возможностей (8)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Средний
Shell command substitution · 2 совпадений
gh pr list --head $(git branch --show-current) --state open --json number,title
This is a real Bash command that runs git inside a GitHub CLI command. The branch value is unquoted, so unusual branch names could cause argument parsing issues even though arbitrary command injection is unlikely.
Средний
Shell command substitution · 2 совпадений
gh pr comment <pr-number> --body "$(cat <<'EOF'
This command posts generated content to GitHub through gh pr comment. The heredoc limits shell expansion inside the body, but it still performs a remote write from skill-controlled workflow output.
Средний
Ruby/shell backtick execution
- Ask: "Push now?" → If yes: `git push`, inform "CodeRabbit will review in ~5 min", EXIT skill
The workflow can run git push, which publishes local commits to the remote repository. The skill asks for user confirmation first, so the risk is bounded but still a real repository mutation.
Средний
Ruby/shell backtick execution
- Ask: "Push changes?" → If yes: `git push`
The workflow can run git push after fixes are committed. It is user-confirmed, but it still publishes changes to the remote repository and should remain explicit.
Средний
Template literal with command substitution · 2 совпадений
```bash
The fenced Bash block contains a GitHub CLI command with command substitution for the current branch. This is legitimate workflow automation, but it should quote the branch value before execution.
Факторы риска
⚙️ Внешние команды (37)
github.md:67-68 github.md:68-70 github.md:70-72 github.md:72-76 github.md:17 github.md:61-64 SKILL.md:28 SKILL.md:29 SKILL.md:31 SKILL.md:36 SKILL.md:40 SKILL.md:42 SKILL.md:49 SKILL.md:57 SKILL.md:63-65 SKILL.md:65-72 SKILL.md:72-75 SKILL.md:75-76 SKILL.md:76 SKILL.md:88-90 SKILL.md:90-103 SKILL.md:103-110 SKILL.md:110-158 SKILL.md:158-167 SKILL.md:167-170 SKILL.md:170-178 SKILL.md:178-184 SKILL.md:184-192 SKILL.md:192-199 SKILL.md:199-200 SKILL.md:200-202 SKILL.md:202-204 SKILL.md:204-208 SKILL.md:64 SKILL.md:193-196 SKILL.md:63-65 SKILL.md:192-199
Аудитор:: codex
2026年6月29日 00:11
Static command and network findings are mostly expected for a GitHub PR automation skill, and the weak cryptography matches are false positives. The material risk is semantic: the workflow tells the agent to execute CodeRabbit review-comment prompts as direct instructions and can apply, commit, and push code changes.
2
Просканировано файлов
332
Проанализировано строк
8
Пункты проверки
1
Ложные срабатывания проигнорированы
Пункты проверки возможностей (5)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Высокий
Untrusted Review Comment Prompt Execution
The skill extracts agent prompts from GitHub review comments and directs the AI to execute those prompts literally. Review comment text is remote content and can carry prompt injection or unsafe code-change instructions, even when the intended source is CodeRabbit.
The wording explicitly says to execute fetched agent prompts as direct instructions and to follow them literally. The source of those prompts is remote GitHub comment content, so the prompt-injection risk is direct and semantic.
Высокий
Automated Code Modification and Publication Workflow
The skill supports an auto-fix mode that applies fixes, creates a consolidated commit, and can push changes. This is high impact when combined with untrusted review-comment instructions because it can publish unintended code changes.
The workflow clearly includes auto-fix, file edits, commit creation, and push prompts. User confirmation is present for mode choice and push, so this is high risk but not confirmed malicious.
Средний
Expected GitHub CLI Commands With Side Effects
The external command findings are largely true positives for intended GitHub automation. The commands query PR data, post comments, create PRs, add files, and commit changes, so users should review permissions and command output.
The commands are real and can affect GitHub or the local repository. They match the stated purpose, which lowers confidence that this is abuse rather than expected functionality.
Средний
Shell Substitution in Command Examples
The examples use shell substitution to derive the branch name and build a multiline PR comment. This is common shell usage, but it still requires normal shell quoting care in repositories with unusual branch names or generated values.
The pattern is present and executable in a shell, but the examples are mostly static GitHub CLI usage. I did not find evidence that arbitrary user input is concatenated into a shell command.
Низкий
Benign Installation URL
The hardcoded URL points to the official GitHub CLI website in installation instructions. This is a normal documentation link rather than a suspicious network destination.
The URL is displayed as an installation reference for GitHub CLI. It is not used for data transfer or hidden network communication.
Статические ложные срабатывания проигнорированы (1)
Эти статические совпадения были отклонены семантической проверкой или совпадали только со схемными токенами, поэтому они показываются для прозрачности, но не влияют на оценку качества.
Низкий
Dismissed Weak Cryptography Static Matches
The static weak cryptography findings do not show cryptographic code. The cited lines are metadata, parsing instructions, or GraphQL fields, so there is no evidence of a weak algorithm implementation.
The cited locations contain prose or GraphQL field names, not cryptographic APIs. I found no encryption, hashing, or cipher selection logic in those locations.
Факторы риска
⚙️ Внешние команды (9)
🌐 Доступ к сети (5)
📁 Доступ к файловой системе (3)
Обнаруженные паттерны
Direct Execution of Fetched Agent PromptsRepository Write and Publish CommandsGitHub Comment Posting Commands
Аудитор:: codex
2026年3月25日 08:01
Security audit completed. Static scanner flagged 71 potential issues but all are false positives. External commands detected are legitimate GitHub CLI operations (gh pr list, gh api graphql, git push) with hardcoded arguments. No user input injection vectors found. SHA references are content hashes for integrity verification, not cryptographic encryption. Network access is limited to official GitHub API endpoints. No prompt injection detected. Skill is safe for publication.
2
Просканировано файлов
332
Проанализировано строк
2
Пункты проверки
0
Ложные срабатывания проигнорированы
Пункты проверки возможностей (1)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Низкий
Shell Command Usage for GitHub Integration
Skill uses shell commands (gh CLI, git) for GitHub integration. These are hardcoded operations with no user input injection risk.
Commands use $(git branch --show-current) which is safe - gets current branch name only, no external input. All gh commands use hardcoded operations against authenticated GitHub CLI.
Факторы риска
Аудитор:: claude