Skills/npm/coderabbitai-mcp

coderabbitai-mcp@1.1.1

CAUTION

Publisher claims: "MCP server for interacting with CodeRabbit AI reviews on GitHub pull requests. Enables LLMs to analyze, implement, and resolve CodeRabbit suggestions programmatically." Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher bradthebeeble · joined 0 days agoInstalls 22,281Last detonated 59 min ago

Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only

t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH

npx invocation of non-well-known packageREADME.md:212 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:16 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:211 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

File permission modification commandpackage.json:16 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Access to sensitive file pathsREADME.md:192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageREADME.md:22 · npx invocation of non-well-known package — may execute untrusted code

AST06