Security audit

Gitlab Skills

Security checks across malware telemetry and agentic risk

Overview

This GitLab skill is coherent and disclosed, but it can perform high-impact GitLab write actions with broad implicit activation and limited confirmation guidance.

Review before installing if the agent has access to a real GitLab token. Use a project-scoped or read-only token whenever possible, avoid broad api scope unless writes are required, and require explicit confirmation before creating issues/MRs, merging MRs, or triggering pipelines. Confirm the project, branch/ref, MR IID, and target GitLab URL before any write action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill clearly relies on sensitive capabilities: it reads authentication material from environment variables or a local config file and performs authenticated network operations against GitLab APIs. Omitting explicit permission declarations can prevent proper consent, review, or sandboxing decisions, increasing the chance the skill is invoked with more authority than users realize.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The top-level description says to use this skill whenever the user wants to work with a GitLab repo, file issues, open or merge MRs, or trigger/check pipelines, which is broad enough to match many generic requests. Overbroad activation can cause the agent to invoke a networked, state-changing skill in situations where a narrower read-only or non-executing response would be safer.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The 'When to use' section lists broad natural-language triggers like 'find or inspect a project' and 'list or trigger CI/CD pipelines' without defining when the skill should not be used. That ambiguity increases the risk of accidental activation for loosely related GitLab questions, potentially leading to unnecessary authenticated API access or unintended state changes.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill enables implicit invocation with no visible trigger constraints, allowing the agent to auto-select a GitLab capability that can inspect projects, create issues/MRs, merge changes, or trigger pipelines. Because this skill performs external side-effecting operations against potentially sensitive GitLab instances, broad implicit invocation increases the chance of unintended or prompt-induced actions without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The manual includes examples for merging merge requests and triggering pipelines without any cautionary language, approval expectations, or confirmation boundaries. In an agent-skill context, these are state-changing operations that can deploy code, consume CI resources, or merge unreviewed changes if invoked too readily by a user or another prompt.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The natural-language activation guidance is broad and only describes when to use the skill, not when not to use it or what confirmation is required for write actions. In an agent environment, vague triggers increase the chance of accidental activation for sensitive operations like creating issues, opening/merging MRs, or triggering pipelines on the wrong project.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.