glab-release

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of the glab CLI tool to manage GitLab releases. Supported operations include create, delete, download, list, upload, and view commands which interact with repository metadata and assets.- [EXTERNAL_DOWNLOADS]: The glab release download command allows the agent to download asset files from GitLab releases. GitLab is a well-known service, and such downloads are considered part of legitimate development workflows.- [INDIRECT_PROMPT_INJECTION]: The skill identifies a potential surface for indirect prompt injection as it processes data from GitLab releases (such as release notes and names) which may be controlled by third parties.
  • Ingestion points: Release metadata and notes are fetched from GitLab repositories or read from local files using the -F flag.
  • Boundary markers: No explicit delimiters are used to separate external release content from the agent's instructions.
  • Capability inventory: The skill enables shell command execution (glab), network access to the GitLab API, and file system operations (reading notes and writing downloaded assets).
  • Sanitization: No sanitization or validation of external release data is performed before it is added to the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 05:21 AM
Security Audit — agent-trust-hub — glab-release