odyssey4me/gitlab
Create and manage GitLab issues, merge requests, pipelines, and repositories using the glab CLI. Use when asked to open an MR, review a merge request, check CI/CD pipelines, list issues, or manage code review on GitLab.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The skill's wrapper and commands (scripts/gitlab.py and SKILL.md) call the glab CLI (e.g., cmd_issues_view, cmd_mrs_view, cmd_pipelines_view) to fetch and format GitLab issues, merge requests, pipeline logs and repository data—which are user-generated/untrusted third-party content—and present them for the agent to read and act on (e.g., review/merge/approve), so external content can materially influence decisions.
Where we found it
gitlab.com
domain · 9 sites
The plugin's wrapper script (scripts/gitlab.py) invokes the glab CLI to fetch GitLab issues, merge requests, pipelines, and repository data from a GitLab instance (defaulting to gitlab.com), formats it as markdown, and presents it to the agent for review/approval decisions — making external user-generated content a direct influence on agent actions.
- Audited
- Security analysis