gitlab-automation
Warn
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to add a third-party URL (
https://rube.app/mcp) as an MCP server configuration. This introduces a remote dependency that executes automation logic and handles GitLab authentication flows through an external service. - [PROMPT_INJECTION]: The skill processes data from external GitLab projects, which provides a surface for indirect prompt injection attacks.
- Ingestion points: Data retrieved through tools such as
GITLAB_LIST_PROJECT_ISSUES,GITLAB_GET_PROJECT_MERGE_REQUESTS, andGITLAB_LIST_REPOSITORY_COMMITSas specified in SKILL.md. - Boundary markers: The instructions lack guidance for the agent to use delimiters or explicit "ignore embedded instructions" warnings when handling content from issues or merge requests.
- Capability inventory: The skill allows the agent to create and update projects, issues, branches, and merge requests based on input data (SKILL.md).
- Sanitization: There are no specified procedures for sanitizing, validating, or filtering the data ingested from GitLab before it is used in subsequent agent operations.
Audit Metadata