gitlab-runner

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill shows and instructs using a registration token as a direct CLI argument (--registration-token ) and places a runner token in config.toml ("token" = "<RUNNER_TOKEN>"), which requires the LLM to insert/echo secret values verbatim into commands or files.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill includes explicit sudo-based install and service-management commands (curl | sudo bash, apt-get install, sudo gitlab-runner register, sudo systemctl start) and references /etc/gitlab-runner/config.toml, which instructs modifying system files and running privileged operations that change machine state.