gitlab-ci-patterns
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous templates that execute shell commands for building (npm, docker), testing (trivy), and deploying (kubectl, terraform) software. These commands are integral to the skill's primary purpose of CI/CD automation.
- [DYNAMIC_EXECUTION]: The documentation includes a pattern for 'Dynamic Child Pipelines' where a Python script is used to generate a YAML configuration file at runtime which is then triggered as a child pipeline.
- [INDIRECT_PROMPT_INJECTION]: The skill defines templates meant to process external repository data and environment variables which may contain untrusted input.
- Ingestion points: CI/CD pipelines ingest project source code, merge request descriptions, and environment variables during the build and test stages.
- Boundary markers: The templates lack boundary markers or instructions to ignore embedded commands in the processed data.
- Capability inventory: The skill possesses capabilities for remote deployments (kubectl), infrastructure modification (terraform), and container registry interaction (docker push).
- Sanitization: There is no evidence of input validation or sanitization within the provided shell script examples.
Audit Metadata