gitlab-ci-generator
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes a local baseline template (
references/templates/gitlab-ci.template.yml) to generate CI/CD configurations, ensuring consistency and avoiding untrusted external templates. - [SAFE]: All pipeline stages use vendor-controlled Docker images (
nextstage/php,nextstage/docker), which is standard for specialized CI/CD tooling. - [SAFE]: Instructions explicitly prohibit the inclusion of secret values in documentation, directing the agent to only list variable names (e.g., GCP keys), which aligns with secure credential management practices.
- [COMMAND_EXECUTION]: The generated template contains standard shell commands for development workflows, including package management (
composer install,yarn install) and deployment scripts. These operations are restricted to the GitLab runner environment. - [SAFE]: Indirect Prompt Injection Surface: The skill reads project configuration files (
package.json,composer.json,docker-compose.yml) to adapt the CI template. This is a necessary functional requirement for CI generation. - Ingestion points:
{product_root}/docker-compose.yml,{product_root}/composer.json,{product_root}/package.json. - Boundary markers: None (standard for this use case).
- Capability inventory: File writing (
.gitlab-ci.yml,ci-cd-notes.md). - Sanitization: The agent performs structural adaptation based on found values rather than direct interpolation of executable content.
Audit Metadata