gitlab-cli-skills Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower

Source:

SHA-256:

gitlab-cli-skills is an AI agent skill, created by vince-winkintel and published at vince-winkintel/gitlab-cli-skills. ClawSecure audited gitlab-cli-skills across 51 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 55/100 (Medium Risk). The 6 findings concentrate in Malicious Code, ReDoS and Permissions Manifest, including Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: .ssh/. 3 were rated high or critical severity.

Is gitlab-cli-skills safe?

ClawSecure audited gitlab-cli-skills and assigned a security score of 55/100 (Medium Risk), identifying 6 findings across Malicious Code and ReDoS. Review the findings below before installing.

What did ClawSecure find in gitlab-cli-skills?

ClawSecure identified 6 findings in gitlab-cli-skills, concentrated in Malicious Code, ReDoS and Permissions Manifest. 3 were rated high or critical severity. The most severe include Attempts to access sensitive file: .ssh/ and Attempts to access sensitive file: .ssh/.

How was gitlab-cli-skills audited?

ClawSecure ran gitlab-cli-skills through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 51 files from vince-winkintel/gitlab-cli-skills.

What does a score of 55 mean?

ClawSecure assigned gitlab-cli-skills a security score of 55/100, placing it in the Medium Risk range. This reflects 6 findings led by Malicious Code that warrant review before production use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for gitlab-cli-skills

ClawSecure detected 6 security findings in gitlab-cli-skills, spanning Malicious Code, ReDoS and Permissions Manifest.

high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in SKILL.md.
high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in commands.md.
high · Attempts to access sensitive file: .ssh/. Malicious Code finding detected in commands.md.
medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
medium · ReDoS vulnerability: Nested quantifiers (potential…. ReDoS finding detected in post-inline-comment.py:73.
medium · ReDoS vulnerability: Python regex with nested quantifiers —…. ReDoS finding detected in post-inline-comment.py:73.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for gitlab-cli-skills

Audit external network connections

gitlab-cli-skills connects to external endpoints. Verify every outbound connection goes to a trusted destination. Unauthorized callbacks are a primary indicator of ClawHavoc malware and data exfiltration. ClawSecure's proprietary engine monitors for known malicious endpoints including C2 infrastructure.

Fix ReDoS-prone patterns

gitlab-cli-skills contains regular expressions vulnerable to catastrophic backtracking (ReDoS). Replace vulnerable patterns, bound input length, and prefer linear-time matching so a crafted input cannot hang the agent.

Add a config.json permissions manifest

A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Related Security Research

ClawHavoc Explained: The Malware Family Targeting AI Agents→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→

Related AI Agent Security Audits

skill-vetter-v2Score 70/100 skill-creatorScore 65/100 skill-creatorScore 65/100 nginx-analyzeScore 60/100 nginx-analyzeScore 60/100

Scanned on July 16, 2026. gitlab-cli-skills is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan