The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes content from GitLab such as issue descriptions, merge request comments, and CI job logs. Because this data is user-generated, it is treated as untrusted and potentially contains malicious instructions aimed at manipulating the AI agent. \n
Evidence: The SECURITY.md file and individual skill files (e.g., glab-ci/SKILL.md, glab-api/SKILL.md) explicitly document the risk of indirect prompt injection.\n
Ingestion points: Operations like glab issue view, glab ci trace, and glab api bring external content into the agent's context.\n
Boundary markers: Scripts like scripts/ci-debug.sh and scripts/create-mr-from-issue.sh utilize --- BEGIN/END EXTERNAL CONTENT --- markers to help the agent distinguish between instructions and data.\n
Capability inventory: The skill can perform network operations (GitLab API), write to the file system (Git operations), and execute specific commands.\n
Sanitization: Input like issue titles is sanitized before use in branch names.\n- [COMMAND_EXECUTION]: The scripts/mr-review-workflow.sh script executes shell commands to run tests during merge request reviews.\n
Evidence: The script runs a test command provided as an argument.\n
Safety Mechanism: To prevent arbitrary code execution, the script validates the command against a hardcoded allowlist of standard test runners (e.g., npm test, pytest, cargo test). It also ensures the Merge Request ID is numeric.\n- [DATA_EXFILTRATION]: The skill manages and uses GitLab authentication tokens to perform API requests.\n
Evidence: Various sub-skills (e.g., glab-auth, glab-token) and scripts handle personal access tokens to interact with the GitLab instance.\n
Context: These network operations are intended for the skill's primary functionality. The skill provides clear security guidance, such as warning users to only upload public SSH keys in glab-ssh-key/SKILL.md.

gitlab-cli-skills