Security audit

GitLab Agent

Security checks across malware telemetry and agentic risk

Overview

This GitLab automation skill is disclosed, but it asks the agent to make authenticated, potentially irreversible repository and account changes without confirmation.

Install only if you want an agent that can act autonomously in GitLab as the token owner. Use a least-privilege token, restrict it to test or low-risk projects where possible, and be prepared for the agent to push branches, create or modify MRs and issues, comment, change CI/CD variables, create releases, or merge without asking first.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to perform write and irreversible external GitLab actions automatically and without confirmation. Because the skill operates with an authenticated GitLab token and can clone, push, create merge requests, and modify project state, this removes an important human approval boundary and can cause unintended or unauthorized account- and repository-impacting actions.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The metadata declares an authenticated GitLab token as the primary environment variable and the skill is designed to act as the logged-in user, but the skill does not include safety warnings or usage constraints around credentialed actions. In context, this increases the risk that the agent will use powerful credentials to make repository, CI/CD, or account-scoped changes without adequate user awareness.

Ssd 1

High

Confidence: 97% confidence
Finding: The skill semantically reframes all write and irreversible actions as already approved, low risk, and safely reversible, which is not generally true for GitLab operations. This undermines normal uncertainty handling and approval safeguards, making it easier for the agent to justify risky actions such as pushes, merge requests, comments, reviewer assignment, or other external changes without validating user intent.

Ssd 1

Medium

Confidence: 83% confidence
Finding: Telling the agent to decide on its own when it has questions or options pressures it to act under ambiguity instead of escalating uncertainty. In a GitLab automation context, ambiguity can involve selecting repositories, issues, branches, reviewers, or remediation actions, so suppressing clarification increases the chance of unintended writes or changes in the wrong project.

Ssd 4

High

Confidence: 95% confidence
Finding: The skill uses persuasive language to normalize trust and then escalates to autonomous irreversible external actions, including clone, push, and merge request creation without confirmation. This is dangerous because it conditions the agent to bypass caution exactly where authenticated external side effects occur, increasing the likelihood of unauthorized or harmful repository operations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.