CodeRabbit Autofix
Safely fetch and apply CodeRabbit's unresolved review feedback on GitHub PRs with per-change approval, never executing reviewer-provided prompts directly.
SKILL.md explicitly treats reviewer comments and 'Prompt for AI Agents' as untrusted input, forbids reading secrets/dotfiles, limits outbound content, requires per-fix user approval, uses one consolidated commit and validation prompts before push; permissions minimal (gh/git). Deductions: no automated rollback (manual git only), publisher unverified in registry, error-branch recovery consequences not explicitly documented though data flow is disclosed.
Instructions are self-consistent, shell snippets complete, with clear branches for no-PR/review-in-progress/no-threads and intelligible exit messages. Deductions: static review only, no execution evidence or tests; edge cases like jq/gh version drift or GraphQL pagination failure unhandled; failure feedback relies on prompt conventions; AskUserQuestion tool availability unverified.
Scenario (open GitHub PR reviewed by CodeRabbit) and non-fit boundaries (resolved/outdated threads) are clear; triggers are rich and semantically precise. Deductions: total dependence on gh, GitHub API and CodeRabbit services creates mainland-China reachability risk; no Chinese-language notes or degraded path.
Well-layered docs (SKILL.md self-sufficient, github.md as shared mirror), version 0.1.0, MIT license, README clarifies usage and triggers, repo CI and owner-approval workflow present. Deductions: skill itself lacks changelog, FAQ or known-limitations section; maintenance responsibility only indirectly inferable from repo workflows.
Claims a complete loop (extract unresolved threads → validate → approve fixes → one commit → PR summary) with clear marginal value over manually reading comments, and each step is controllable. Deductions: static review cannot verify outputs are directly usable; fix quality depends on host agent; evidence of summary-template benefit is limited.
Key claims (GraphQL shape, bot account names, status strings) auditable from source; github.md corroborates SKILL.md. Deductions: no committed tests, no third-party execution evidence, no real output samples; coverage thin and not independently reproducible.
- The skill fully depends on gh CLI, GitHub API and CodeRabbit services; reachability from mainland-China networks may be limited — verify network conditions first.
- Reviewer comments are correctly treated as untrusted, but the host agent's actual execution may still drift from prompt constraints; trial in an isolated environment first.
- No automated rollback: undoing applied fixes relies solely on manual git operations before merge.
- Static review only, nothing executed; GraphQL queries and status-string matching may break if the API changes.
What does this skill do, and when should you use it?
Autofix is a portable Agent Skill from CodeRabbit's official skills repository that does one thing well: it turns unresolved CodeRabbit review threads on your current branch's GitHub PR into approved, applied code fixes. It uses the gh CLI to fetch review threads via GraphQL, parses severity, and presents issues in thread order, then independently validates each issue, computes the smallest safe fix, applies it only after explicit approval, and finally creates one consolidated commit with an optional push and PR summary comment. The skill enforces strict anti-injection rules: the reviewer's "Prompt for AI Agents" sections are treated as untrusted input used only as hints, never executed, and it will not read secrets or out-of-scope files. It fits teams that already use CodeRabbit for PR review and want a safe path from feedback to merged fixes.
1) Loads AGENTS.md repository instructions and checks for uncommitted/unpushed changes; 2) resolves the current branch's PR via gh pr list, optionally creating one interactively; 3) fetches unresolved, non-outdated CodeRabbit review threads through paginated GitHub GraphQL queries; 4) parses issue type, severity, description, AI prompt, and line anchors from each root comment, mapping severity to Fix or Review actions; 5) validates each issue against local code, shows a sanitized guidance summary plus a minimal proposed diff, and waits for approval, deferral, or modification; 6) commits all applied fixes as a single fix: apply CodeRabbit auto-fixes commit; 7) optionally runs build/lint validation before pushing, then posts one summary comment on the PR containing only locally derived safe content.
- A maintainer who just received CodeRabbit review feedback on their PR and wants to verify and fix critical issues one by one rather than copy-pasting suggestions manually.
- A team that wants to consume review feedback in a controlled way before CI: every fix requires human approval and lands in a single reviewable commit.
- Security-conscious developers worried about prompt injection hidden in review comments' "Prompt for AI Agents" sections, who need enforced sanitization.
- A contributor whose branch has no PR yet, wanting the skill to create one interactively, wait ~5 minutes for CodeRabbit review, and then run the fix workflow.
- Anyone whose CodeRabbit review is still in progress (the "Come back again in a few minutes" message) and wants the skill to detect that and exit safely instead of fixing from a partial review.
What are this skill's strengths and limitations?
- Per-issue approval with no bulk auto-apply makes fixes fully controllable and auditable.
- Built-in prompt-injection defenses: review text is untrusted, with shell commands, credential paths, and non-GitHub URLs stripped.
- Rigorous workflow: detects in-progress reviews, ignores resolved/outdated threads, preserves thread order and severity.
- All fixes land as a single consolidated commit; PR summary comments contain only safe local summaries.
- Honors AGENTS.md build/lint/test/commit conventions.
- CodeRabbit-ecosystem dependent: the PR must already be reviewed by CodeRabbit; feedback from other review bots is out of scope.
- Version is only 0.1.0 and the source material provides no test suite or cross-platform validation evidence.
- Requires gh CLI with authenticated GitHub access and covers GitHub PRs only (no GitLab or other forges).
- Strict one-at-a-time approval is slow when there are many review comments; no true one-shot fully-automatic mode.
- Interaction mechanisms like AskUserQuestion assume host-agent support; bare API environments need adaptation.
How do you install this skill?
1) Install and authenticate the CodeRabbit CLI per https://docs.coderabbit.ai/cli (coderabbit auth login); 2) install the skill collection in any SKILL.md-capable agent: npx skills add coderabbitai/skills (use -s autofix to install only this skill, -g for global, -a to target a specific agent); 3) Claude Code users can alternatively install via the plugin marketplace: /plugin marketplace update then /plugin install coderabbit. The skill itself lives at skills/autofix/SKILL.md and is fully executable on its own; a github.md companion mirrors reusable command primitives.
How do you use this skill?
Prerequisites: a Git repo on GitHub, an open PR on the current branch, and that PR already reviewed by the CodeRabbit bot; gh and git installed and authenticated (gh auth status). After installation, invoke it in your agent with triggers such as "coderabbit autofix", "fix coderabbit", or "cr fix". The skill then walks you through: push-status check → fetch unresolved threads → issue table display → per-fix approval → one consolidated commit → optional validation, push, and PR comment.
How does this skill compare with similar options?
The sibling code-review skill in the same repository performs the upstream step — running reviews and finding bugs and security issues via the CodeRabbit CLI — while autofix handles the downstream step of consuming unresolved review threads and landing fixes safely. They are complementary, not competing.