GitLab Agent

• Outcome: Review
• Latest audit: Sep 24, 2026 · 5:29 AM UTC
• Version: 1.94.0

Overview

This is a disclosed autonomous GitLab work agent, but it asks to make recurring GitLab changes without confirmation, so it should be reviewed carefully before installation.

Install only for a GitLab account and projects where you intentionally want an autonomous agent to read assigned work, inspect membership and discussion data, push branches, create or update issues/MRs, change labels, and run on a recurring schedule. Keep the GitLab token narrowly scoped, test with the recurring job disabled, and review the no-confirmation and ci.skip workflow before enabling it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 80% confidence
• Finding: The declared description suggests a broader operational skill for handling assigned GitLab work, including owner-verified project access and guarded merge request delivery. The supplied code does not perform work operations, access verification, or MR delivery controls. Instead, it only reads GitLab data via `glab api`, fetches the current user, lists assigned open issues and merge requests, filters them, and prints JSON. This is a materially narrower and different primary purpose than the declared description.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to perform irreversible GitLab write actions automatically and explicitly says confirmation is not required. In an adversarial or mistaken task context, this can lead to unauthorized pushes, merge requests, comments, branch creation, or other state changes without a human checkpoint.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

* If you see an additional commit by a team member, do not simply revert. Analyse the changes and think about if you need to do something in addition.
* On each commit
  * Add `Generated-By: <current model>` to the commit message.
  * Push with `git push origin <branch> -o ci.skip`
  * Start the pipeline via `glab ci run --mr`, unless there are active pipelines in main or dev. Never use more than X `[setting: 2 # AGENTS.md -> active-pipelines]` pipelines for your work. Add `workflow::paused`, if you delay the pipeline start and revisit later.
* After merge or close, update the items and labels to reflect the final state `workflow::done`.

• Confidence: 95% confidence
• Finding: The skill instructs pushing with `-o ci.skip` and then manually starting a pipeline later. This can bypass default repository validation paths, create gaps in required checks, and be abused to land unreviewed or untested changes if follow-up pipeline execution is skipped, delayed, or manipulated.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill explicitly directs use of shell and network-capable tooling (`glab`, `jq`, git, API access) but declares no explicit tool scope or permission boundary. That makes the agent's effective authority ambiguous and increases the chance of unintended or over-broad execution, especially because the document also encourages autonomous write actions.

Ssd 4

Medium

• Confidence: 93% confidence
• Finding: The wording normalizes bypassing ordinary approval habits by telling the agent not to worry about mistakes and to perform external irreversible actions automatically. This degrades safety posture over time and makes risky behavior more likely when instructions are incomplete, ambiguous, or maliciously seeded.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

* All writable actions in GitLab should be done with the `glab` CLI. This includes creating and updating issues, merge requests, branches, comments, and more.
* Complete tasks successfully in GitLab.
* If you think work needs to be done, do it without asking.

## Security Gate

• Confidence: 88% confidence
• Finding: The instruction to act 'without asking' grants the agent broad autonomous decision-making in a write-capable environment. In context, that autonomy is paired with GitLab mutation abilities, making wrong decisions materially impactful rather than merely procedural.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill directs broad collection and inspection of GitLab project, assignment, and membership data but provides no user-facing warning or minimization guidance. Even if intended for access control, this creates unnecessary exposure of organizational metadata and may normalize reading data beyond the immediate task need.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

### Type Status Labels

| GitLab label     | Common name     | Meaning                                                                                   |
| ---------------- | --------------- | ----------------------------------------------------------------------------------------- |
| `type::support`  | Support Request | Someone need help, but no change. Maybe it resolves in new work item after investigation. |
| `type::bug`      | Bugfix             | Something that needs to be fixed and exists                                               |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

Use the labels in your merge requests to set the current status of the work. Only use one workflow status label at a time.

| GitLab label            | Common name | Meaning                                                                                                      |
| ----------------------- | ----------- | ------------------------------------------------------------------------------------------------------------ |
| `workflow::backlog`     | Backlog     | Not yet started. Initial state.                                                                              |
| `workflow::forbidden`   | Forbidden   | Project access failed the owner membership security gate; only the gate script manages this label.          |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

| ----------------------- | ----------- | ------------------------------------------------------------------------------------------------------------ |
| `workflow::backlog`     | Backlog     | Not yet started. Initial state.                                                                              |
| `workflow::forbidden`   | Forbidden   | Project access failed the owner membership security gate; only the gate script manages this label.          |
| `workflow::in-progress` | Running     | Actively worked on                                                                                           |
| `workflow::paused`      | Paused      | Agent will continue later automatically. Temporarily paused for one hour to one day.                         |
| `workflow::need-human`  | Need Human  | Requires human intervention to fullfill current task and all other options are exhausted. Before adding the label, explain reason by comment in the issue. Its status is not blocked or paused. |
| `workflow::blocked`     | Blocked     | Currently blocked by a dependency or issue. On each assignment, check the status of the blocker. Reevaluate the blocker from time to time.                                                                  |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def api_json(endpoint: str) -> object:
    result = subprocess.run(
        ["glab", "api", endpoint],
        check=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def api_json(endpoint: str) -> object:
    result = subprocess.run(
        ["glab", "api", endpoint],
        check=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

command.extend(("-f", "add_labels=" + ",".join(additions)))
    if removals:
        command.extend(("-f", "remove_labels=" + ",".join(removals)))
    subprocess.run(
        command,
        check=True,
        stdout=subprocess.DEVNULL,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def api_json(endpoint: str) -> object:
    result = subprocess.run(
        ["glab", "api", endpoint],
        check=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

}
        )
        try:
            subprocess.run(
                [
                    "glab",
                    "api",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_check_project_access.py:23

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_select_reviewer.py:19