Security audit

GitLab Agent Self Improvement

Security checks for vulnerabilities and agentic risk

Overview

This skill is presented as personal self-improvement but can use a GitLab token to create and close merge requests in a live project.

Review this before installing unless you explicitly want an agent to manage merge requests in the named GitLab project. Install only with a GitLab token whose permissions are tightly scoped, and require user approval before creating, assigning, or closing merge requests.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is presented as personal self-improvement, but its actual behavior directs the agent to perform GitLab repository maintenance actions, including creating merge requests and closing older ones. This mismatch can cause unintended privileged actions because users or orchestration systems may invoke the skill under a harmless-sounding label without realizing it can modify project state.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill lacks concrete trigger phrases or activation boundaries, so it may be invoked in overly broad contexts whenever an agent is asked about improvement or reflection. Because the skill includes repository-modifying actions, ambiguous activation increases the chance of accidental execution and unintended changes to GitLab project state.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions tell the agent to create, assign, and close merge requests without any user-facing warning that these actions modify persistent project state. This is dangerous because users may treat the skill as advisory, while the agent is actually empowered to make consequential changes to a live GitLab workflow.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The instruction to close older merge requests grants the skill authority to alter or terminate existing work artifacts without a purpose consistent with self-improvement. In context, this can disrupt collaboration, discard active work, or suppress review history, especially if the agent applies the rule mechanically or without human approval.

Static analysis

No suspicious patterns detected.