gitlab-mr-review
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill interpolates the
{source_branch}and{merge_request_iid}variables directly into shell commands executed via the terminal. - Evidence: Step 2 and Step 8 use these variables in
git fetch,git worktree add, andgit worktree removecommands. - Impact: A malicious actor could name a branch with shell metacharacters (e.g.,
; rm -rf /) to attempt command injection when the agent checks out the branch. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from GitLab MR metadata and repository files, which could contain malicious instructions designed to manipulate the agent's behavior.
- Ingestion points: Step 1 fetches MR titles, descriptions, and discussions. Step 3 and 4 analyze the codebase files and diffs.
- Capability inventory: The agent has terminal access (
run_in_terminal) and GitLab write permissions (posting comments, approving MRs, changing MR status). - Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore embedded commands within the MR content or code.
- Sanitization: No sanitization process is described for the external content before it is processed by the AI or subagents.
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of a specific third-party GitLab MCP server from a public GitHub repository.
- Evidence: Step 0 points users to
https://github.com/zereight/gitlab-mcp/tree/mainif capabilities are missing.
Audit Metadata