review-gitlab
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes untrusted data from GitLab merge requests (titles, descriptions, comments, and code diffs). An attacker with access to the GitLab repository could craft content that attempts to override the agent's instructions during the analysis phase.\n
- Ingestion points: GitLab merge request data (title, description, diffs, comments) fetched via
scripts/gitlab.mjsin SKILL.md Steps 3, 5, and 6.\n - Boundary markers: Absent. The instructions do not define delimiters or specific safety instructions to isolate untrusted external content.\n
- Capability inventory: Execution of shell commands via
node scripts/gitlab.mjs, network connectivity to the GitLab API (POST, PUT, DELETE), and filesystem access (writing to/tmp/and reading local source files via the Read tool).\n - Sanitization: Absent. Content retrieved from GitLab is processed directly without escaping or validation.\n- [DATA_EXFILTRATION]: The custom CLI script
scripts/gitlab.mjsutilizes a--body-fileflag that permits reading arbitrary files from the filesystem and transmitting their content to the configured GitLab host via the Notes or Discussions API. While this is a functional requirement for posting review comments, it provides a mechanism for data exfiltration if the agent's reasoning is subverted.\n- [COMMAND_EXECUTION]: The skill performs project interaction by executing a local JavaScript file (scripts/gitlab.mjs) using Node.js to manage GitLab API requests.
Audit Metadata