gitlab-docs-publishing
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates high security maturity and follows best practices for CI/CD tooling.
- [INDIRECT_PROMPT_INJECTION]: The injection script processes external HTML and JSON configuration files. It effectively mitigates injection risks by strictly escaping JSON payloads to prevent potential XSS through script-breaking sequences.
- [COMMAND_EXECUTION]: Security-conscious file handling is implemented in the injection scripts, featuring atomic writes and symlink resolution checks to prevent path traversal or unauthorized file overwrites during the documentation build process.
- [OBFUSCATION]: Static analysis identified hidden Unicode characters (U+2028 and U+2029) in the build scripts. Investigation confirmed these are being explicitly sanitized to prevent script context breakout in browsers, representing a security feature rather than an attack vector.
Audit Metadata