gitlab-sync
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard developer tools, specifically the
gitCLI and theglab(GitLab CLI), to perform repository management and merge operations. - Evidence: Commands such as
git fetch --all --prune,git merge origin/builds/dev/<app>, andglab mr createare used to automate the synchronization workflow. - Context: These commands are used for their intended purpose in a developer environment and include logical checks (e.g., verifying branch existence) before execution.
- [PROMPT_INJECTION]: The skill defines a set of "Safety rules" and "Rules không bao giờ vi phạm" (Rules never to violate) to ensure the agent maintains branch integrity.
- Evidence: Instructions explicitly forbid merging build branches back into the main branch and prohibit force-pushing without explicit user confirmation.
- Context: These are protective constraints designed to prevent the AI from making accidental or harmful changes to the codebase, rather than malicious overrides.
- [EXTERNAL_DOWNLOADS]: The skill mentions the requirement of the
glabCLI tool but does not attempt to download or install any external binaries or scripts during execution. - Evidence: A link to the official GitLab CLI documentation is provided for the user's reference, rather than a direct download command.
- [DATA_EXFILTRATION]: No evidence of data exfiltration was found. All network-related operations are performed via standard Git and GitLab CLI tools targeting the configured repository origin.
- [SAFE]: The skill follows industry best practices for monorepo management, including the use of ephemeral sync branches and the preservation of environment-specific configurations during conflict resolution.
Audit Metadata