gitlab-cli-skills Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

gitlab-cli-skills is an AI agent skill, created by vince-winkintel and published at openclaw/skills. ClawSecure audited gitlab-cli-skills across 51 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 60/100 (Medium Risk). The 6 findings concentrate in Malicious Code, Command Injection and Permissions Manifest, including Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: .ssh/. 3 were rated high or critical severity.

Is gitlab-cli-skills safe?

ClawSecure audited gitlab-cli-skills and assigned a security score of 60/100 (Medium Risk), identifying 6 findings across Malicious Code and Command Injection. Review the findings below before installing.

What did ClawSecure find in gitlab-cli-skills?

ClawSecure identified 6 findings in gitlab-cli-skills, concentrated in Malicious Code, Command Injection and Permissions Manifest. 3 were rated high or critical severity. The most severe include Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: .ssh/.

How was gitlab-cli-skills audited?

ClawSecure ran gitlab-cli-skills through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 51 files from openclaw/skills.

What does a score of 60 mean?

ClawSecure assigned gitlab-cli-skills a security score of 60/100, placing it in the Medium Risk range. This reflects 6 findings led by Malicious Code that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for gitlab-cli-skills

ClawSecure detected 6 security findings in gitlab-cli-skills, spanning Malicious Code, Command Injection, Permissions Manifest and Policy Violation.

high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in SKILL.md.
high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in commands.md.
high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in commands.md.
medium · Code block in glab-mr/SKILL.md at line 161 contains…. Command Injection finding detected in glab-mr/SKILL.md:161.
medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
info · Missing License Declaration. Policy Violation finding detected in SKILL.md.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for gitlab-cli-skills

Audit external network connections

gitlab-cli-skills connects to external endpoints. Verify every outbound connection goes to a trusted destination. Unauthorized callbacks are a primary indicator of ClawHavoc malware and data exfiltration. ClawSecure's proprietary engine monitors for known malicious endpoints including C2 infrastructure.

Harden command execution

gitlab-cli-skills constructs or runs system commands. Validate that commands are built only from trusted inputs, never pass user-controlled strings directly to a shell, and restrict execution to an allow-list of expected commands.

Add a config.json permissions manifest

A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Related Security Research

ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→

Related AI Agent Security Audits

gitlab-cli-skillsScore 55/100 devops-mainScore 75/100 devops-mainScore 75/100 devops-mainScore 75/100 skill-vetter-v2Score 70/100

Scanned on March 8, 2026. gitlab-cli-skills is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan