The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface where external, untrusted data can influence the agent's behavior.
Ingestion points: Untrusted data enters the context via tools that read merge request diffs (get_merge_request_file_diff), issue descriptions (get_issue), file contents (get_file_contents), and pipeline job logs (get_pipeline_job_output) as described in SKILL.md and reference/pipelines.md.
Boundary markers: The skill documentation does not mention the use of delimiters or specific instructions to the agent to disregard embedded commands in the ingested data.
Capability inventory: The skill provides extensive write and administrative capabilities, including pushing code changes (push_files), approving merge requests, and managing project/group variables (SKILL.md).
Sanitization: No sanitization or validation logic for external data is specified in the instruction files.
[COMMAND_EXECUTION]: The skill includes the gitlab_api_request tool, which is documented to bypass security restrictions such as GITLAB_ALLOWED_GROUPS, project allowlists, and individual tool safety checks (SKILL.md). This tool exposes the full permission scope of the underlying GitLab token, allowing the agent to perform arbitrary API operations if manipulated.

gitlab-mcp-skill