ClawHub
Back to skill

Security audit

Gitlab Mr Review Pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated GitLab MR review purpose, but it handles repository tokens, email credentials, private diffs, and automated email delivery with several under-scoped security controls.

Review this skill carefully before installing. Use only HTTPS GitLab hosts, restrict the GitLab token to the minimum scopes and repositories, avoid entering secrets in recorded or shared terminals, and confirm that generated reports may be emailed to MR authors. Pin and review the dependency skills before use, and consider adding a human approval step before outbound email is sent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/init-config.py:25
Finding

GitLab Access Token May Be Transmitted Over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/init-config.py:78
Finding

GitLab and Email Credentials Are Entered Through Echoing Terminal Prompts

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:128
Finding

Untrusted Merge-Request Diff Content Is Embedded Directly Into Agent Instructions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/mr-records.py:28
Finding

Processed Merge-Request Records Are Written Without Explicit Restrictive Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Executable Skill Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (30)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

声明描述的是一个完整的 MR 审核流水线，核心能力应包括获取/处理 MR、AI 审查、生成报告、发送邮件。而实际代码仅实现了本地文件清理与统计：删除 file/mr-code-review-report.md、/tmp/code_review_prompt.txt，以及 mr-reports 目录下过期 PDF 文件。虽然“清理临时文件和旧报告”可能是该流水线的辅助维护组件，但就这个代码块本身而言，其实际行为与声明的主要用途明显不一致，且包含未在描述中体现的删除本地文件能力。因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个完整的自动化 MR 代码审核流水线，核心能力应包括对 MR 内容进行 AI 审查、生成审查报告并发送邮件。实际代码仅实现了一个基础的 GitLab API 工具脚本：从本地配置读取 GitLab 凭据，调用 GitLab API 获取 MR 列表、diff、commits，以及检查仓库可访问性，并将结果打印输出。虽然这些能力可能是审核流水线的支撑组件，但就该代码块本身而言，其行为与声明的主要用途存在明显差异，且缺少声明中的关键功能，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The skill requires storing a GitLab API token and email authorization code in a local JSON configuration file. Although credential use is necessary for the workflow, storing long-lived secrets in plaintext materially increases the risk of credential theft through local compromise, misconfigured permissions, backups, or accidental disclosure.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
| 字段 | 说明 | 必需 |
|------|------|------|
| `gitlab.host` | GitLab 地址 | 是 |
| `gitlab.access_token` | Access Token（需 api 权限） | 是 |
| `email.provider` | 邮箱服务商（163/qq/126） | 是 |
| `email.address` | 邮箱地址 | 是 |
| `email.auth_code` | 邮箱授权码（非登录密码） | 是 |

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow sends MR diff content to an AI review skill and later sends author email data and generated reports through an email system, but the skill text does not provide a clear upfront warning or consent gate. This creates a meaningful confidentiality and privacy risk because source code, repository metadata, and personal contact information may be disclosed to external processors.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

md
**原因**: Token 无效或过期

**解决**: 重新生成 Access Token

### 仓库不存在

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The script collects sensitive credentials interactively using plain input(), which echoes the GitLab access token and email authorization code to the terminal. This can expose secrets to shoulder surfing, terminal recording/logging, shell session capture, or other local monitoring, which is more concerning in a pipeline/automation context where privileged tokens may grant repository and API access.

Content

Scanner excerpt · scripts/init-config.py (reported line 85)May include surrounding context.

python
# GitLab 配置
    print("=== GitLab 配置 ===")
    gitlab_host = get_input("GitLab 地址（如 http://gitlab.example.com）")
    gitlab_token = get_input("GitLab Access Token")
    
    # 验证 GitLab Token
    print("\n正在验证 GitLab Token...")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README describes an automated code review pipeline that emails reports to MR submitters but does not prominently warn users that repository-derived content will be transmitted externally via email. This omission can lead to unintentional disclosure of sensitive code review details, especially in private or regulated repositories.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to install a dependency skill via npx clawhub install glab-cli without pinning a specific version or immutable reference. This creates a supply-chain risk because later or compromised releases could be fetched and executed during installation, and this pipeline has access to GitLab tokens and email credentials, increasing the blast radius.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The code-review dependency is installed via an unpinned npx clawhub install command, allowing the resolved package version to change over time. Because this skill automates review of repository contents and likely processes sensitive code, a malicious or compromised upstream package could exfiltrate data or alter review results.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README installs md-to-pdf-advanced without a pinned version, introducing a mutable external dependency into the workflow. In a pipeline that transforms generated reports and handles potentially sensitive MR data, a malicious package update could execute unintended code or leak report contents.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The email-mail-master installation command is also unpinned, which is risky because email tooling commonly handles credentials, recipient data, and attachments. A compromised or unexpected package version could misuse stored email auth data or silently transmit reports elsewhere.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase 帮我审核 GitLab 仓库的 MR is broad and close to an ordinary user request, making accidental invocation likely. Since this skill can query MRs, process diffs, generate reports, and send emails, unintended activation could cause unreviewed data access and outbound transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The configuration section instructs users to store GitLab access tokens and email credentials in a local config file without clearly warning about the sensitivity of these secrets or expected file protections. Exposure of these credentials could enable repository access, data exfiltration, and unauthorized email sending, which is particularly dangerous in an automated pipeline.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill describes use of file I/O, shell commands, and network access but does not declare any explicit tool scope or permission boundaries. In an agent setting, this increases the chance of over-privileged execution and makes it harder for users or the platform to understand and constrain what the skill may do.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

Using npx clawhub without a pinned version allows the installed package or resolved dependency tree to change over time. This creates a supply-chain risk where a malicious or compromised upstream release could be fetched and executed unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

Using npx clawhub without a pinned version allows the installed package or resolved dependency tree to change over time. This creates a supply-chain risk where a malicious or compromised upstream release could be fetched and executed unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

Using npx clawhub without a pinned version allows the installed package or resolved dependency tree to change over time. This creates a supply-chain risk where a malicious or compromised upstream release could be fetched and executed unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

Using npx clawhub without a pinned version allows the installed package or resolved dependency tree to change over time. This creates a supply-chain risk where a malicious or compromised upstream release could be fetched and executed unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrase is broad enough that ordinary user requests about reviewing GitLab MRs could invoke a workflow that accesses repositories, processes code diffs, generates files, and sends emails. Overbroad activation increases the risk of unintended execution of sensitive actions without explicit informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The cleanup step deletes temporary markdown files and older PDF reports but is presented as optional maintenance without a strong warning about destructive effects. In practice, users may trigger it without realizing audit artifacts or reports could be removed, reducing recoverability and traceability.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

解决: 安装中文字体

bash
sudo apt-get install fonts-noto-color-emoji fonts-wqy-zenhei
fc-cache -fv

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 393)May include surrounding context.

  1. 配置文件权限: 设置为 600

    bash
    chmod 600 ~/.config/gitlab-mr-review-pipeline/config.json

  2. Token 安全: 不要将 Token 提交到版本控制

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description is written entirely in Chinese and presents the skill's behavior in that language without any indication that users can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. This creates a natural-language locale policy concern because it implicitly enforces a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown template is entirely written in Chinese and presents fixed report headings and instructions in that language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains user-facing natural-language strings in Chinese in the module docstring and throughout the CLI, but there is no indication that the skill is region-specific or that users can choose another language. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.