GitLab Agent

• Outcome: Review
• Latest audit: Nov 8, 2026 · 3:30 PM UTC
• Version: 1.133.0

Overview

ClawScan marks this skill suspicious with high confidence because it reports broad GitLab actions that exceed the stated guarded, owner-verified work scope and can affect projects without those checks.

Consider not installing until the project authorization and action limits are clear. Skillspector's analysis is partial: it inspected the listed components but could not resolve several local references, so its evidence is incomplete. The verdict is suspicious, not a claim that the author is malicious.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/list-active-items.py

Finding

Group short-name collisions bypass the collaborator allowlist

Content

View full analysis

Impact

An unapproved requester can cause the agent to adopt and process their issues using its authorized project account. This defeats the requester restriction and can initiate unwanted repository work and merge-request creation; arbitrary code execution or unrestricted merging is not established by this finding.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (38)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Release creation is a distinct project-changing capability not declared by the stated merge-request workflow. The supplied command also shows no owner-verification or delivery safeguards. This is a material capability mismatch, not merely a supporting implementation detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The commands concern GitLab merge-request delivery, consistent with the general purpose, but the supplied chunk does not implement the declared verification and safeguards. It attempts approval and merge before checkout, with no visible checks of project ownership, assignment, or delivery conditions. GitLab may enforce server-side restrictions, but the chunk does not establish the owner-verified, guarded workflow it claims.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Configured collaborator adoption and incident adoption are explicitly documented, so they are not inherently hidden behavior. However, discovery is instructed to replace workflow labels on objects that fail owner verification, allowing writes in projects the authorization gate has rejected and potentially disrupting their workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code implements meaningful MR safeguards, including source-branch naming restrictions and protected-target validation. However, it does not implement the declared owner-verification boundary: project_path is accepted directly, and no owner approval or work-assignment check precedes project access or MR creation. The --target-source option merely accepts a caller-provided provenance label; it does not verify that provenance. Existing GitLab authentication and authorization do not establish owner approval. This mismatch is limited to the supplied code chunk; another component could potentially provide the missing verification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The supplied commands manage CI/CD variables directly rather than implement a merge-request workflow. Variable modification changes project configuration outside MR delivery, and the chunk shows no owner verification or delivery guards. This is a substantive undeclared capability, not merely a supporting implementation detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

Reporting assigned work is a reasonable supporting function of the declared purpose, and the supplied code does not visibly perform GitLab writes. However, the pending-to-do loop bypasses the owner-membership and active-project gates applied to issues and merge requests. It includes every pending to-do returned by the API; owner_addressed is merely an output annotation, not a filter. This expands the report beyond the declared owner-verified scope. The dynamically imported helper's implementation is not supplied, so its additional behavior cannot be verified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

Issue creation is related to GitLab work, but the supplied command performs a write without the declared owner-verification safeguards or any connection to assigned work. It does not implement a guarded merge-request workflow. The mismatch concerns the unguarded action, not merely the absence of merge-request operations.

Content

No source excerpt is available for this finding.

Isolation and presumed owner consent are used to justify unrestricted external actions.

High

• Category: Prompt Injection
• Confidence: 98% confidence

Finding

The skill asserts blanket prior consent for external and irreversible actions and incorrectly treats container isolation and developer permissions as making every write low risk. GitLab writes can publish sensitive information, trigger privileged CI, or change repository state; the later gates limit targets but do not establish authorization for every consequential action.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

* If you see an additional commit by a team member, do not simply revert. Analyse the changes and think about if you need to do something in addition.
* On each commit
  * Add `Generated-By: <current model>` to the commit message.
  * Push with `git push origin <branch> -o ci.skip`
  * Start the pipeline via `glab ci run --mr`, unless there are active pipelines in main or dev. Never use more than X `[setting: 2 # AGENTS.md -> active-pipelines]` pipelines for your work. Add `workflow::paused`, if you delay the pipeline start and revisit later.
* After merge or close, update the items and labels to reflect the final state `workflow::done`.

Instructs the agent to suppress unfixed vulnerability findings without warning about the security implications.

High

• Category: Output Handling
• Confidence: 97% confidence

Finding

For unfixed CVEs, the skill mandates an ignore MR and forbids vulnerability-related blocking without requiring exploitability assessment, compensating controls, an expiration, or authorized risk acceptance. Although tracking issues preserve some visibility, this policy can suppress meaningful security gates and allow vulnerable software to be delivered.

Content

No source excerpt is available for this finding.

Project operations are not gated on the manifest's promised owner-verified access.

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The script accepts an arbitrary project path and checks MR assignment and GitLab permissions, but never establishes the owner-verified project authorization promised by the skill description. If this entry point is invoked without an external authorization gate, a caller can direct the agent's credentials at an unapproved project, including reviewer changes and potentially automatic merging; MR assignment is not equivalent to owner approval.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

Autonomous execution is appropriate for an agent, but 'if you think work needs to be done' makes the agent's judgment sufficient to initiate additional work without an explicit task-scope boundary. Project and assignment gates reduce exposure but do not prevent self-created work from expanding beyond the owner's intended objectives.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

* All writable actions in GitLab should be done with the `glab` CLI. This includes creating and updating issues, merge requests, branches, comments, and more.
* Complete tasks successfully in GitLab.
* If you think work needs to be done, do it without asking.

## Security Gate

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

For authorized changes to `gitlab-org/gitlab`, follow the [GitLab contribution guide](https://docs.gitlab.com/development/contributing/) in addition to the gates above.

1. Confirm contributor onboarding and write access to the maintained community fork before publishing. Prefer that fork over importing a personal full fork; this is a GitLab-specific exception to the agent-owned fork rule. Do not claim onboarding is complete without verification.
2. Write the issue and MR in English. Work on a community-fork branch and target the canonical repository's `master`. Follow upstream commit and testing guidelines; include reproduction steps and the required automated test results in the MR description.
3. Use the link from `@gitlab-bot` for labels and review requests, or `@gitlab-bot help` for an MR coach. After addressing review feedback, comment `@gitlab-bot ready`. Verify required checks before claiming review readiness; keep local workflow state on

L215 mandates daily updates and conflict resolution for all forked repositories, exceeding the manifest's assigned-work, owner-verified scope.

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

Daily maintenance is mandated for all forked repositories without limiting it to active, authorized work or explicitly reapplying the project gate. Updating default branches and resolving conflicts can therefore modify unrelated or deliberately diverged forks using the agent's broader account access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list-active-items.py (reported line 42)May include surrounding context.

python

def api_read(command, **kwargs):
    """Retry one timed-out API read, never a mutation or invalid response."""
    try:
        return subprocess.run(command, timeout=25, **kwargs)
    except subprocess.TimeoutExpired:
        import time

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list-active-items.py (reported line 48)May include surrounding context.

python

print("GitLab API read timed out after 25s; retrying once", file=sys.stderr)
        time.sleep(1)
    return subprocess.run(command, timeout=25, **kwargs)


def api_json(endpoint: str) -> object:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list-active-items.py (reported line 195)May include surrounding context.

python

command.extend(("-f", "add_labels=" + ",".join(additions)))
        if removals:
            command.extend(("-f", "remove_labels=" + ",".join(removals)))
        subprocess.run(command, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    return sorted((current | set(additions)) - set(removals))

Items in projects that fail owner verification are still modified.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Items that fail owner verification still reach synchronize_forbidden, which adds workflow::forbidden and removes other workflow labels. Thus a project outside the owner's approved scope can still be modified using the agent's broader GitLab permissions, potentially disrupting workflow state or label-triggered automation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list-active-items.py (reported line 472)May include surrounding context.

python

continue
                command = ["glab", "api", "-X", "PUT", "-f", f"assignee_ids={user_id}", endpoint]
                try:
                    write = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE)
                    result = json.loads(write.stdout)
                except (OSError, subprocess.SubprocessError, json.JSONDecodeError):
                    result = None

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list-active-items.py (reported line 605)May include surrounding context.

python

if removals:
        command += ["-f", "remove_labels=" + ",".join(sorted(removals))]
    command.append(endpoint)
    result = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE)
    adopted = json.loads(result.stdout)
    if not isinstance(adopted, dict) or username not in [
        assignee.get("username") for assignee in adopted.get("assignees", [])

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list-directly-addressed-todos.py (reported line 21)May include surrounding context.

python

def api_json(endpoint: str) -> object:
    result = subprocess.run(
        ["glab", "api", endpoint], check=True, text=True, stdout=subprocess.PIPE
    )
    return json.loads(result.stdout)

Tainted flow: 'endpoint' from os.environ.get (line 49, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/list-directly-addressed-todos.py (reported line 21)May include surrounding context.

python

def api_json(endpoint: str) -> object:
    result = subprocess.run(
        ["glab", "api", endpoint], check=True, text=True, stdout=subprocess.PIPE
    )
    return json.loads(result.stdout)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mr-create.py (reported line 40)May include surrounding context.

python

def api_text(endpoint: str) -> str:
    result = subprocess.run(
        ["glab", "api", endpoint],
        check=True,
        text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/select-reviewer.py (reported line 28)May include surrounding context.

python

def api_text(endpoint: str) -> str:
    result = subprocess.run(
        ["glab", "api", endpoint],
        check=True,
        text=True,