gitlab-babysit-mr
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection vulnerability identified in the processing of GitLab job logs. Untrusted data from CI logs is used to build instructions for the Duo Developer bot.
- Ingestion points: GitLab job logs (fetched via
scripts/job_log_tail.sh). - Boundary markers: None implemented; log snippets are interpolated directly into bot instructions.
- Capability inventory: Use of
glab apito post MR notes/commands andgit pushfor local fixes. - Sanitization: ANSI escape codes and CI markers are stripped, but raw text remains unvalidated before use in prompts.
- [COMMAND_EXECUTION]: The skill performs local execution of development toolchains for automated linting repairs.
- Evidence: Execution of
bundle exec rubocop,yarn run eslint,yarn run prettier, andbundle exec haml-linton repository files. - Context: While appropriate for the skill's purpose, this behavior relies on the safety of the repository's configuration files and toolchain environment.
Audit Metadata