gitlab-cli-skills Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

gitlab-cli-skills is an AI agent skill, created by vince-winkintel and published at openclaw/skills. ClawSecure audited gitlab-cli-skills across 51 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 60/100 (Medium Risk). The 6 findings concentrate in Malicious Code, Policy Violation and Command Injection, including Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: .ssh/. 3 were rated high or critical severity.

Is gitlab-cli-skills safe?

ClawSecure audited gitlab-cli-skills and assigned a security score of 60/100 (Medium Risk), identifying 6 findings across Malicious Code and Policy Violation. Review the findings below before installing.

What did ClawSecure find in gitlab-cli-skills?

ClawSecure identified 6 findings in gitlab-cli-skills, concentrated in Malicious Code, Policy Violation and Command Injection. 3 were rated high or critical severity. The most severe include Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: .ssh/.

How was gitlab-cli-skills audited?

ClawSecure ran gitlab-cli-skills through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 51 files from openclaw/skills.

What does a score of 60 mean?

ClawSecure assigned gitlab-cli-skills a security score of 60/100, placing it in the Medium Risk range. This reflects 6 findings led by Malicious Code that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for gitlab-cli-skills

ClawSecure detected 6 security findings in gitlab-cli-skills, spanning Malicious Code, Policy Violation, Command Injection and Permissions Manifest.

high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in SKILL.md.
high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in commands.md.
high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in commands.md.
medium · Code block in glab-mr/SKILL.md at line 171 contains potentially.... Command Injection finding detected in glab-mr/SKILL.md:171.
medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
info · Skill manifest does not include a 'license' field. Specifying a license.... Policy Violation finding detected in SKILL.md.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for gitlab-cli-skills

Audit external network connections

gitlab-cli-skills connects to external endpoints. Verify every outbound connection goes to a trusted destination. Unauthorized callbacks are a primary indicator of ClawHavoc malware and data exfiltration. ClawSecure's proprietary engine monitors for known malicious endpoints including C2 infrastructure.

Resolve policy violations

gitlab-cli-skills trips ClawSecure policy checks. Review each flagged pattern against your security policy and remediate or document an accepted exception before production use.

Harden command execution

gitlab-cli-skills constructs or runs system commands. Validate that commands are built only from trusted inputs, never pass user-controlled strings directly to a shell, and restrict execution to an allow-list of expected commands.

Related Security Research

ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→

Related AI Agent Security Audits

4f12f0da6eb7a565Score 65/100 2fccdde2f962fa7cScore 55/100 19af8eafb16b72f6Score 75/100 ClawSecScore 45/100 b4abd97bcb77151aScore 75/100

Scanned on April 16, 2026. gitlab-cli-skills is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan