glab-api
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns such as direct prompt injection, obfuscation, or persistence mechanisms were detected.
- [PROMPT_INJECTION]: The skill identifies an indirect prompt injection attack surface because it fetches user-generated content from GitLab (issue bodies, logs, commits). It mitigates this risk by including a mandatory security instruction for the agent to treat all fetched content as data only and ignore embedded instructions.
- [COMMAND_EXECUTION]: The skill uses the 'glab' command-line interface to perform API requests. This is the intended primary function of the skill.
- [DATA_EXFILTRATION]: While the skill communicates with GitLab APIs, this is standard behavior for the tool. It preserves legitimate session headers (GitLab Duo) and does not exhibit patterns of sensitive data exfiltration to unauthorized third-party domains.
Audit Metadata