glab-dependency-firewall
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents wrapper commands that execute various package manager binaries (e.g., npm, pip, cargo, yarn).
- Evidence: SKILL.md lists wrappers for cargo, bundle, gem, gradle, maven, npm, pip, pipenv, pnpm, poetry, twine, uv, and yarn.
- Context: The documentation explicitly warns that these package managers can download, install, execute build scripts, or upload packages, and advises users to verify targets before invocation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of package URLs (PURLs) and CI logs which could contain malicious instructions.
- Ingestion points: The purl argument in the package command and the contents of .gitlab/df/ci-log.json read by the ci-summary command.
- Boundary markers: None explicitly mentioned for the prompt construction.
- Capability inventory: Execution of glab subcommands which can invoke external binaries.
- Sanitization: Documentation claims the tool validates PURL formats and NuGet download shapes.
- [DYNAMIC_EXECUTION]: The Yarn wrapper uses a temporary injected plugin to modify network settings at runtime.
- Evidence: SKILL.md describes a temporary injected plugin for Yarn that clears per-host networkSettings to enforce the use of the firewall proxy.
- Context: This is described as a non-persistent modification intended to ensure security policy enforcement during the execution of the package manager.
Audit Metadata