gitlab-sync

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard developer tools, specifically the git CLI and the glab (GitLab CLI), to perform repository management and merge operations.
  • Evidence: Commands such as git fetch --all --prune, git merge origin/builds/dev/<app>, and glab mr create are used to automate the synchronization workflow.
  • Context: These commands are used for their intended purpose in a developer environment and include logical checks (e.g., verifying branch existence) before execution.
  • [PROMPT_INJECTION]: The skill defines a set of "Safety rules" and "Rules không bao giờ vi phạm" (Rules never to violate) to ensure the agent maintains branch integrity.
  • Evidence: Instructions explicitly forbid merging build branches back into the main branch and prohibit force-pushing without explicit user confirmation.
  • Context: These are protective constraints designed to prevent the AI from making accidental or harmful changes to the codebase, rather than malicious overrides.
  • [EXTERNAL_DOWNLOADS]: The skill mentions the requirement of the glab CLI tool but does not attempt to download or install any external binaries or scripts during execution.
  • Evidence: A link to the official GitLab CLI documentation is provided for the user's reference, rather than a direct download command.
  • [DATA_EXFILTRATION]: No evidence of data exfiltration was found. All network-related operations are performed via standard Git and GitLab CLI tools targeting the configured repository origin.
  • [SAFE]: The skill follows industry best practices for monorepo management, including the use of ephemeral sync branches and the preservation of environment-specific configurations during conflict resolution.
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 03:45 PM
Security Audit — agent-trust-hub — gitlab-sync