gitlab-code-reviewer

• Analyzed: May 11, 2026, 5:03 AM
• Findings: 1
• Version: 1.0.2
• Hash: 44cf4960cf7807968d299c5f77b12366a5ba3cd08154ba9f7f671f6d2ea1e0dd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle is designed for GitLab MR code reviews. It reads necessary GitLab API credentials from `~/.openclaw/credentials/gitlab.json` and uses them to fetch MR data and post comments. The `SKILL.md` instructions explicitly guide the AI agent to perform token scope checks, restrict actions (e.g., no auto-approval, no labels), and use a dedicated script (`scripts/post_comments.py`) with a temporary JSON file for posting comments, specifically to avoid shell escaping issues with comment bodies. The Python scripts (`gitlab_client.py`, `ignore_matcher.py`, `post_comments.py`) use standard libraries, parse URLs with regex, and interact with the GitLab API without any evidence of data exfiltration, malicious execution (e.g., `eval`/`exec` of untrusted input), persistence mechanisms, or prompt injection attempts against the agent. The design includes safeguards and adheres to the stated purpose.