The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes content from external, attacker-controllable sources within GitLab.\n
Ingestion points: Tools such as get_merge_request_file_diff (in reference/code-review.md), get_issue (in reference/issues.md), and get_pipeline_job_output (in reference/pipelines.md) pull potentially untrusted data into the agent's active context.\n
Boundary markers: The instructions lack explicit delimiters or guidance for the agent to distinguish between its core instructions and data retrieved from GitLab objects.\n
Capability inventory: The skill includes high-impact tools such as push_files, create_or_update_file, merge_merge_request, and execute_graphql (all described in SKILL.md).\n
Sanitization: There is no specified mechanism for sanitizing or validating the content retrieved from the GitLab API before it is processed by the AI agent.\n- [COMMAND_EXECUTION]: The skill exposes numerous tools for performing high-privilege and destructive operations on the GitLab instance.\n
Evidence: The SKILL.md file explicitly identifies a set of 'Destructive Tools' including delete_issue, merge_merge_request, and push_files. While these are expected for the skill's purpose, they provide a significant surface for unauthorized modifications if the agent's logic is subverted through injection.

gitlab-mcp-skill