glab-variable
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a documentation wrapper for the legitimate 'glab' CLI tool. It prioritizes security by warning users that output can expose secret values and advising that exported variables should be kept out of version control.
- [INDIRECT_PROMPT_INJECTION]: The skill enables an agent to ingest data from an external source (GitLab CI variables) and subsequently perform write operations.
- Ingestion points:
glab variable list,glab variable get, andglab variable exportinreferences/commands.md. - Boundary markers: None explicitly present in the skill instructions.
- Capability inventory:
glab variable set,glab variable update, andglab variable deletecommands inreferences/commands.mdallow for state modification. - Sanitization: No specific sanitization or escaping of the variable content is described, though use of JSON output format is mentioned.
Audit Metadata