Security Audit Report

gitlab-cli-skills

Caution

by vince-winkintel · 51 files · 4/30/2026, 1:19:09 PM

🔭 Continuously monitored by ClawSecure Watchtower

Findings

  • Total Findings: 6
  • Critical: 0
  • High: 3
  • Medium: 2
  • Low: 0
  • Info: 1

Source: https://clawhub.ai/vince-winkintel/gitlab-cli-skills

SHA-256: 30be0333df99...

Overview:
gitlab-cli-skills is an Other skill for the OpenClaw ecosystem, created by vince-winkintel. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 60/100, indicating moderate risk areas that should be addressed. The audit identified 6 findings, with issues detected across multiple security layers.

3-Layer Audit Protocol

🛡 ClawSecure Proprietary Engine

  • Finding: Missing config.json - agent may not be properly configured.
  • Finding: Attempts to access sensitive file: .ssh/
    CRITICAL

🔒 Advanced Static & Behavioral Analysis

  • Finding: Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
  • Finding: Code block in glab-mr/SKILL.md at line 174 contains potentially dangerous Python code.
    WARNING

📦 Supply Chain Security

  • Issues Detected: No issues detected
    PASS

HIGH Findings

  1. F-001 Attempts to access sensitive file: .ssh/

    • Category: ASI03 (Identity & Privilege Abuse)
    • File: SKILL.md

  2. F-002 Attempts to access sensitive file: .ssh/

    • Category: ASI03 (Identity & Privilege Abuse)
    • File: commands.md

  3. F-003 Attempts to access sensitive file: .ssh/

    • Category: ASI03 (Identity & Privilege Abuse)
    • File: commands.md

MEDIUM Findings

  1. F-001 Code block in glab-mr/SKILL.md at line 174 contains...

    • File: glab-mr/SKILL.md:174

  2. F-002 Missing config.json - agent may not be properly configured

    • Category: ASI03

INFO Findings

  1. F-001 Skill manifest does not include a 'license' field....
    • File: SKILL.md

OWASP ASI Framework Coverage

  • ASI01 Agent Goal Hijack
  • ASI02 Tool Misuse
  • ASI03 Identity & Privilege
  • ASI04 Agentic Supply Chain
  • ASI05 Unexpected Code Execution
  • ASI06 Memory & Context
  • ASI07 Insecure Inter-Agent Communication
  • ASI08 Cascading Failures
  • ASI09 Human-Agent Trust Exploitation
  • ASI10 Rogue Agents

Categories highlighted were detected in this scan. ClawSecure provides comprehensive coverage across all 10 OWASP ASI Top 10 categories.

Context-Aware Analysis

This skill requests system-level capabilities which are standard for OpenClaw automation skills. ClawSecure's Context-Aware Intelligence analyzes capabilities in ecosystem context. Our 3-Layer Audit Protocol differentiates real threats from normal agent functionality.

Security Recommendations for gitlab-cli-skills

  1. Pin npm dependencies: Use exact version numbers in package.json to prevent unauthorized code from entering your dependency tree.
  2. Add a config.json permissions manifest: Declare what permissions your OpenClaw skill needs for user visibility before installing.
  3. Review shell execution permissions: Validate that commands are constructed from trusted inputs only.

Related OpenClaw Security Research

Related Other Security Audits

Scanned on April 30, 2026. gitlab-cli-skills is one of 2,890+ agents audited by ClawSecure from the community-curated awesome-openclaw-skills list.