Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward GitLab CLI helper, but users should be careful because some examples can change repositories or reveal CI/CD variables.
Install only if you want your agent to use your existing glab access for GitLab work. Treat merge, approve, release, variable, and raw API commands as sensitive: confirm the target project and identifier first, and do not expose secret CI/CD variable values in chat or logs.
The skill documents state-changing GitLab operations like approving, merging, and checking out merge requests without any caution that these commands can alter repository state or trigger downstream automation. In an agent skill context, this increases the chance an automated system executes impactful actions on production repositories without explicit user confirmation.
The variable management examples show listing, setting, and retrieving CI/CD variables with no warning that these values may be secrets and should not be echoed, logged, or exposed in transcripts. In a CLI-driven agent environment, demonstrating glab variable get and inline secret setting can directly lead to credential disclosure or unsafe secret handling.
The release creation example publishes a release without warning that it creates externally visible project artifacts and may trigger notifications or downstream consumption. While lower risk than secret exposure or merge operations, it is still a state-changing action that can cause accidental publication if used by an autonomous agent.
No suspicious patterns detected.
