feat: add pf-security-scan skill to code-review plugin#139
Conversation
Introduces a PatternFly security audit skill covering XSS, unsanitized user input, and insecure href patterns. Co-authored-by: Cursor <cursoragent@cursor.com>
📝 WalkthroughWalkthroughAdds the PF Security Scan skill, documenting PatternFly XSS and insecure URL checks, remediation guidance, reference patterns, assistant routing, plugin listings, contribution guidance, and the README skills badge update. ChangesPF Security Scan
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsLinked repositories: Public OSS repositories can only analyze public repositories installed in this organization. No linked repositories were analyzed; skipped Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
plugins/code-review/skills/pf-security-scan/SKILL.md (3)
10-12: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNitpick: Keep the skill tool-agnostic.
Naming
@patternfly/patternfly-mcpmakes the instructions specific to one integration. Describe the outcome—consult available PatternFly API documentation—while retaining a fallback that works without a particular tool.As per path instructions, skills must be tool-agnostic and work in both Claude Code and Cursor without tool-specific references.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/code-review/skills/pf-security-scan/SKILL.md` around lines 10 - 12, Update the “PatternFly MCP” section in SKILL.md to use tool-agnostic wording that instructs agents to consult available PatternFly API documentation for unfamiliar component props and link-rendering behavior. Retain a fallback for environments without documentation tools, and remove the specific `@patternfly/patternfly-mcp` integration reference.Source: Path instructions
119-128: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueNitpick: Add language tags to the report examples.
Use
textfor both output-only fenced blocks to satisfy markdownlint and make rendering explicit.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/code-review/skills/pf-security-scan/SKILL.md` around lines 119 - 128, Update both output-only fenced code blocks in the report examples within SKILL.md to specify the text language tag, preserving their contents and formatting otherwise.Source: Linters/SAST tools
1-4: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winNitpick: Add an eval for this consumer-facing skill.
The provided changes add
pf-security-scan/SKILL.mdbut no correspondingeval/pf-security-scan/coverage. Add focused cases proving detection of PF XSS and unsafe URL patterns.As per path instructions, consumer-facing skills are expected to have an eval — see
CONTRIBUTING-SKILLS.mdfor details.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/code-review/skills/pf-security-scan/SKILL.md` around lines 1 - 4, Add consumer-facing evaluation coverage for the pf-security-scan skill under eval/pf-security-scan/. Include focused cases that verify detection of PatternFly XSS risks, including dangerouslySetInnerHTML and unsanitized user-controlled content, plus unsafe href or URL patterns, following the structure and requirements in CONTRIBUTING-SKILLS.md.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/code-review/skills/pf-security-scan/references/anti-patterns.md`:
- Around line 7-9: Update the PatternFly import search command in the
anti-pattern scan instructions to match both single- and double-quoted imports,
and include supported require-style imports. Preserve the existing recursive
file extensions and ensure SKILL.md uses the broadened search so valid
PatternFly dependencies are not omitted.
---
Nitpick comments:
In `@plugins/code-review/skills/pf-security-scan/SKILL.md`:
- Around line 10-12: Update the “PatternFly MCP” section in SKILL.md to use
tool-agnostic wording that instructs agents to consult available PatternFly API
documentation for unfamiliar component props and link-rendering behavior. Retain
a fallback for environments without documentation tools, and remove the specific
`@patternfly/patternfly-mcp` integration reference.
- Around line 119-128: Update both output-only fenced code blocks in the report
examples within SKILL.md to specify the text language tag, preserving their
contents and formatting otherwise.
- Around line 1-4: Add consumer-facing evaluation coverage for the
pf-security-scan skill under eval/pf-security-scan/. Include focused cases that
verify detection of PatternFly XSS risks, including dangerouslySetInnerHTML and
unsanitized user-controlled content, plus unsafe href or URL patterns, following
the structure and requirements in CONTRIBUTING-SKILLS.md.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 4a4815f7-b101-4676-9c88-79f0462ade43
📒 Files selected for processing (7)
CONTRIBUTING-SKILLS.mdPLUGINS.mdREADME.mdplugins/code-review/README.mdplugins/code-review/agents/pf-assist.mdplugins/code-review/skills/pf-security-scan/SKILL.mdplugins/code-review/skills/pf-security-scan/references/anti-patterns.md
| ```bash | ||
| # Files using PatternFly React | ||
| rg "from '@patternfly/react" --glob '*.{tsx,ts,jsx,js}' |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
Include double-quoted imports in the scan scope.
This command only matches from '@patternfly/react…'. Because SKILL.md uses this step to identify files for scanning, valid imports such as from "@patternfly/react-core" can be excluded entirely, producing a false “clean” result. Match both quote styles (and any supported require form).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@plugins/code-review/skills/pf-security-scan/references/anti-patterns.md`
around lines 7 - 9, Update the PatternFly import search command in the
anti-pattern scan instructions to match both single- and double-quoted imports,
and include supported require-style imports. Preserve the existing recursive
file extensions and ensure SKILL.md uses the broadened search so valid
PatternFly dependencies are not omitted.
Migrate the security audit skill from patternfly/ai-helpers#139, re-listing pf-code-review in the marketplace now that it has a consumer-facing skill. Co-authored-by: Cursor <cursoragent@cursor.com>
1 participant
Introduces a PatternFly security audit skill covering XSS, unsanitized user input, and insecure href patterns.
Summary by CodeRabbit
New Features
Documentation