Security audit

Gitlab Workflow

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent GitLab workflow helper, but it needs review because it combines GitLab write authority, local repository shell commands, and an unpinned third-party plugin.

Install only if you are comfortable granting the MorphixAI integration access to your GitLab account and allowing the agent to run local git commands for selected repositories. Use least-privilege GitLab permissions, prefer a pinned or reviewed plugin version if available, and require explicit approval before actions that approve, merge, retry pipelines, or change MR and issue state.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Unpinned Installation of a Privileged Third-Party Plugin
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and main heading/body are written as mandatory Chinese-facing instructions, with no indication that another language can be used or that the user may choose a locale. This can violate a language/locale policy when a skill effectively constrains interaction language without explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill expands from GitLab API usage into local shell execution and filesystem discovery (nodes.run, find, cd, git fetch, git diff), which materially broadens its authority from remote project operations to local host access. In an adversarial or multi-repo environment, this can expose local repository contents, metadata, branch names, or developer credentials/config context, and it bypasses the stated safety boundary of accessing GitLab only through the MorphixAI proxy.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Lines L223-L234 present manual status verification as mandatory before merging, while L244 states the merge action already performs the check and does not require a manual pre-check. These instructions actively contradict each other and could mislead an agent about the intended safe merge procedure.
Content: No source excerpt is available for this finding.