Skills/ClawHub/gitlab-cli-skills

gitlab-cli-skills@1.13.39

CAUTION· install only

Publisher claims: "Comprehensive GitLab CLI (glab) command reference and workflows for all GitLab operations. Use when working with merge requests, CI/CD pipelines, issues, releases, repositories, authentication, variables, labels, milestones, snippets, or any glab command. Covers 40+ sub-commands including glab mr, glab ci, glab issue, glab repo, glab release, glab variable, and more." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher vince-winkintel · publishing for 123 daysInstalls 9,367Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: References a credential file in the home directory; References a credential file in the home directory; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
References a credential file in the home directorySKILL.md:851 · References a credential file in the home directory- `--npm` writes a `//{host}{path}/:_authToken` entry to `~/.npmrc`; you must still configure `registry=` or `@scope:registry=` to point npm at the registry.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
References a credential file in the home directorySKILL.md:881 · References a credential file in the home directory…ME/.docker}/config.json`, `~/.m2/settings.xml`, `~/.gradle/gradle.properties`, `~/.npmrc`, `~/.yarnrc.yml`, or the sbt destination files listed above (or the explicit `…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsSKILL.md:2177 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessource ~/.config/openclaw/env/gitlab-<agent>.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Authorization escalation languageSKILL.md:5761 · Authorization escalation language- Runner controller commands require GitLab admin privilegesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandSKILL.md:50 · File permission modification command — agent changes file ownership/permissions…ese env files outside version control, restrict their permissions (for example `chmod 600`), be mindful of backup exposure, and use least-privilege bot/service-accoun…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandSKILL.md:1091 · Privileged sudo command — agent may execute with elevated privileges… and then replaces the original. On snap installs, connect keyring access with `sudo snap connect glab:password-manager-service` if encrypted credential storage is r…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsSKILL.md:1898 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…fig access The snap uses the manual-connect `dot-kube-config` plug, scoped to `~/.kube/config` and `~/.kube/config.lock`, rather than the whole `.kube` directory. A d…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationSKILL.md:4544 · Credential pass-through configuration — agent relays sensitive credentials- Do not pass credentials manually on the command line or in logs.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actionSKILL.md:892 · File type combined with upload action — agent may exfiltrate local data files…e exact registry key. The config path is `${DOCKER_CONFIG:-$HOME/.docker}/config.json`. Do not display the file or raw helper values in agent output, logs, or chat. Keep the current helper unless the operator explicitly approves a migratio…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
References a credential file in the home directorySKILL.md:1898 · References a credential file in the home directory…fig access The snap uses the manual-connect `dot-kube-config` plug, scoped to `~/.kube/config` and `~/.kube/config.lock`, rather than the whole `.kube` directory. A differen…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:3597 · MCP server using network transport (SSE/HTTP) — data sent over network… to the [GitLab MCP Server](https://docs.gitlab.com/user/model_context_protocol/mcp_server/) and collects feedback in [work item 8618](https://gitlab.com/gitlab-org/cli/-/work_items/8618). Existing stdio behavior is doc…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Access to sensitive file pathsSKILL.md:1135 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessource ~/.config/openclaw/env/gitlab-<actor>.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionSKILL.md:2476 · File type combined with upload action — agent may exfiltrate local data files…g task's result and the firewall summary. The wrapper writes `.gitlab/df/ci-log.json` in the working directory on local runs as well as CI runs. Keep that activity log out of commits; review an appropriate `.gitignore` entry before use. Bl…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Authorization escalation languageSKILL.md:5772 · Authorization escalation language- Verify admin privilegesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandSKILL.md:1128 · File permission modification command — agent changes file ownership/permissions…ese env files outside version control, restrict their permissions (for example `chmod 600`), be mindful of backup exposure, and prefer least-privilege bot/service-acc…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Authorization escalation languageSKILL.md:5957 · Authorization escalation language- Instance-level runner management requires GitLab admin privileges.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsSKILL.md:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessource ~/.config/openclaw/env/gitlab-<actor>.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationSKILL.md:2374 · Credential pass-through configuration — agent relays sensitive credentials… not apply `NO_PROXY`, while Cargo does. Review the actual destination and keep proxy credentials out of argv/output. Maven downloads through a mirror are matched against known…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
References a credential file in the home directorySKILL.md:6685 · References a credential file in the home directory- ✅ Public keys: `~/.ssh/id_rsa.pub`, `~/.ssh/id_ed25519.pub` (`.pub` extension)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Credential pass-through configurationSKILL.md:1382 · Credential pass-through configuration — agent relays sensitive credentialsPass credentials by their supported file flags, or by an already securely provisioned environment; never put values in argv, shell assignments captured in history, or output:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actionSKILL.md:2764 · File type combined with upload action — agent may exfiltrate local data files…s Claude Code, installs its `Stop` and `SessionEnd` hooks in `~/.claude/settings.json`, and installs a durable fallback periodic sync job on macOS/Linux. Later runs reuse the previously selected agents. Obtain approval for both the setting…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Authorization escalation languageSKILL.md:5558 · Authorization escalation language- Requires GitLab admin privilegesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandSKILL.md:2171 · File permission modification command — agent changes file ownership/permissionsKeep these env files outside version control, restrict their permissions (for example `chmod 600`), be mindful of backup exposure, and use least-privilege bot/service-account tokens.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈87,127 tok
1 file · 2 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim vince-winkintel: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim vince-winkintelPropose a patch to the maintainer