ClawHub
Back to skill

Security audit

GitLab Agent

Security checks across malware telemetry and agentic risk

Overview

This is a real GitLab work agent, but it grants unattended authority to change repositories and project state beyond a narrow assigned-task scope.

Install only if you intentionally want an autonomous GitLab agent that can use your GitLab token to create and update issues, comments, branches, merge requests, labels, pipelines, forks, and possibly releases or variables. Use a narrowly scoped GitLab account/token, confirm the owner and assignment gates fit your projects, and avoid enabling the recurring job unless unattended changes every 15 minutes are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The manifest describes operating assigned GitLab work with guarded MR delivery, which implies task-scoped handling of assigned items. However, the skill additionally directs a once-daily maintenance sweep over all forked repositories, including updating forks from upstream and resolving merge conflicts, which is broader ongoing repository maintenance rather than handling assigned GitLab work.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The manifest purpose is focused on working assigned GitLab items and guarded merge request delivery. Documenting and enabling `glab variable set/get/list` introduces CI/CD secret and configuration management capabilities that are materially different from issue/MR execution and are not justified by the stated scope.

Context-Inappropriate Capability

Low
Confidence
90% confidence
Finding
Creating GitLab releases is a deployment/release-management capability, not an obvious requirement for handling assigned issues and merge requests. The manifest does not mention release administration, so this expands the agent's operational capability beyond its stated purpose.

Missing User Warnings

High
Confidence
96% confidence
Finding
This markdown file directs the agent to perform write actions, cloning, pushing, and merge-request creation automatically without explicit confirmation. Because the skill description itself is the user-facing behavior contract, it lacks an appropriate warning about the potential impact on repositories and project state and instead discourages caution.

Missing User Warnings

High
Confidence
92% confidence
Finding
The bootstrap section instructs enabling a scheduled job that runs the agent every 15 minutes, while the skill elsewhere authorizes autonomous write operations. The markdown does not provide a prominent warning that enabling this schedule can cause ongoing unattended changes in GitLab projects.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
* All writable actions in GitLab should be done with the `glab` CLI. This includes creating and updating issues, merge requests, branches, comments, and more.
* Complete tasks successfully in GitLab.
* If you think work needs to be done, do it without asking.

## Security Gate
Confidence
75% confidence
Finding
without asking

Tool Parameter Abuse

High
Category
Tool Misuse
Content
* If you see an additional commit by a team member, do not simply revert. Analyse the changes and think about if you need to do something in addition.
* On each commit
  * Add `Generated-By: <current model>` to the commit message.
  * Push with `git push origin <branch> -o ci.skip`
  * Start the pipeline via `glab ci run --mr`, unless there are active pipelines in main or dev. Never use more than X `[setting: 2 # AGENTS.md -> active-pipelines]` pipelines for your work. Add `workflow::paused`, if you delay the pipeline start and revisit later.
* After merge or close, update the items and labels to reflect the final state `workflow::done`.
Confidence
70% confidence
Finding
git push origin <branch> -o ci.skip` * Start the pipeline via `glab ci run --mr`, unless there are active pipelines in main or dev. Never use more than X `[setting: 2 # AGENTS.md -> active-pipelines

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.