Security audit

Gitlab Mr Review

Security checks for vulnerabilities and agentic risk

Overview

This GitLab review skill is mostly purpose-aligned, but it can automatically post to merge requests and change GitLab CLI host configuration without clear confirmation or scoping.

Review the generated comment before allowing this skill to post to GitLab. Prefer limiting it to trusted GitLab hosts, avoid persistent `glab config` changes when possible, and remove or approve the fixed OpenClaw attribution before publishing comments in a team repository.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

Location: code-review-template.md:42
Finding: Forced Third-Party Branding in Generated Review Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:18
Finding: Unsafe Interpolation of User-Controlled GitLab URL Components into Shell Commands
Content: View full analysis
``` ### Step 3: Fetch MR Information ```bash glab api projects//merge_requests/ ``` ### Step 4: Fetch MR Changes (Diff) ```bash glab api projects//merge_requests//changes ``` ``` The hostname, project path, and merge-request IID originate from a user-supplied URL. The workflow places these values into shell-oriented command examples without specifying strict validation, shell-safe argument handling, or an approved-host policy. ### Technical Analysis If an implementation substitutes URL components into these command strings and executes them through a shell, shell metacharacters embedded in a crafted component may be interpreted as command syntax. The issue arises from combining untrusted input with command construction rather than passing validated values as discrete process arguments. The workflow also permits an arbitrary hostname to become the configured GitLab host. This can direct API traffic to an attacker-controlled GitLab-compatible endpoint. Depending on the local `glab` configuration and credential-selection behavior, this may cause unintended authenticated requests or expose request metadata. Credential disclosure is environment-dependent and is not guaranteed by the files alone. Changing the configured host also mutates CLI state beyond a single API request. This may affect later commands if the configuration is not restored. ### Attack Path 1. An attacker supplies a crafted merge-request URL containing a malicious hos ...[truncated 1456 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs posting a review comment back to the remote GitLab merge request, but it does not warn the user or require confirmation before performing this write action. That creates a real safety issue because analyzing an MR is a read-oriented task, while publishing comments is an external side effect that could leak generated content, create spam, or modify a real collaboration workflow without clear user consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The markdown content is written entirely in Chinese and presents the review template and usage instructions as the default workflow, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The example trigger and review template fields are presented in Chinese, indicating the skill is designed to operate in a specific language/locale. The file does not state that language choice is optional or limited to a justified region-specific context, which can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.