glab-variable

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill serves as a documentation wrapper for the legitimate 'glab' CLI tool. It prioritizes security by warning users that output can expose secret values and advising that exported variables should be kept out of version control.
  • [INDIRECT_PROMPT_INJECTION]: The skill enables an agent to ingest data from an external source (GitLab CI variables) and subsequently perform write operations.
  • Ingestion points: glab variable list, glab variable get, and glab variable export in references/commands.md.
  • Boundary markers: None explicitly present in the skill instructions.
  • Capability inventory: glab variable set, glab variable update, and glab variable delete commands in references/commands.md allow for state modification.
  • Sanitization: No specific sanitization or escaping of the variable content is described, though use of JSON output format is mentioned.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 09:10 AM