gitlab-public-recon

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.95). The skill explicitly downloads repository files and echoes/prints matched secrets and CI/CD variables (including attempting to fetch project variables), which requires handling and outputting secret values verbatim.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). These are self-hosted GitLab API and web endpoints that allow enumerating projects and downloading raw repository files (CI configs, scripts, binaries, secrets), so they can be abused to distribute malware or harvest credentials if public or misconfigured.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This skill explicitly instructs enumerating GitLab projects to locate and download secrets, keys, CI/CD tokens, and internal infrastructure information for exfiltration and token testing.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill targets GitLab public-repo discovery and then reads arbitrary free text content from outsider-authored repository files at runtime via GitLab API endpoints (e.g., raw file contents for .gitlab-ci.yml, .env, and repository/tree listings), so an outsider can poison/submit malicious file content that the workflow ingests.