glab-mr

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local git commands and the glab CLI to manage branch state, stage changes, and push merge requests to GitLab. These actions are standard for development workflows and targeted at a well-known service.
  • [INDIRECT_PROMPT_INJECTION]: The skill accesses external project data which presents a potential surface for indirect prompt injection.
  • Ingestion points: It reads repository-level merge request templates, ticket context, and existing merge request descriptions from the host environment.
  • Boundary markers: No explicit delimiters are specified to isolate external data from the agent's core instructions.
  • Capability inventory: The skill can perform file staging (git add), local commits (git commit), and network-based merge request creation/updates (glab mr create/update).
  • Sanitization: The skill incorporates a specific security instruction to exclude environment files and secrets from commits unless the user provides an explicit, reviewed authorization.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 01:12 AM