dev-feedback
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runwithin its Python scripts (fetch_mrs.pyandfetch_mr_details.py) to invoke the officialglabCLI for interacting with GitLab APIs. The arguments (username, project ID, MR IID, hostname) are passed as a list to the subprocess, which mitigates standard shell injection risks. The skill explicitly requires the user to grant permissions for these scripts in the environment configuration.
Audit Metadata