# Security Audit Report

## gitlab-cli-skills

Caution

by vince-winkintel · 51 files · 4/30/2026, 1:19:09 PM

🔭 Continuously monitored by ClawSecure Watchtower

### Findings

- **Total Findings:** 6  
- **Critical:** 0  
- **High:** 3  
- **Medium:** 2  
- **Low:** 0  
- **Info:** 1

**Source:** [https://clawhub.ai/vince-winkintel/gitlab-cli-skills](https://clawhub.ai/vince-winkintel/gitlab-cli-skills)

**SHA-256:** 30be0333df99...

**Overview:**  
gitlab-cli-skills is an Other skill for the OpenClaw ecosystem, created by vince-winkintel. ClawSecure audited this skill through our 3-Layer Audit Protocol covering all 10 OWASP ASI Top 10 categories. This skill received a security score of 60/100, indicating moderate risk areas that should be addressed. The audit identified 6 findings, with issues detected across multiple security layers.

## 3-Layer Audit Protocol

### 🛡 ClawSecure Proprietary Engine
- **Finding:** Missing config.json - agent may not be properly configured.
- **Finding:** Attempts to access sensitive file: .ssh/  
**CRITICAL**

### 🔒 Advanced Static & Behavioral Analysis
- **Finding:** Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
- **Finding:** Code block in glab-mr/SKILL.md at line 174 contains potentially dangerous Python code.  
**WARNING**

### 📦 Supply Chain Security
- **Issues Detected:** No issues detected  
**PASS**

## HIGH Findings

1. **F-001** Attempts to access sensitive file: .ssh/  
   - **Category:** ASI03 (Identity & Privilege Abuse)  
   - **File:** SKILL.md

2. **F-002** Attempts to access sensitive file: .ssh/  
   - **Category:** ASI03 (Identity & Privilege Abuse)  
   - **File:** commands.md

3. **F-003** Attempts to access sensitive file: .ssh/  
   - **Category:** ASI03 (Identity & Privilege Abuse)  
   - **File:** commands.md

## MEDIUM Findings

1. **F-001** Code block in glab-mr/SKILL.md at line 174 contains...  
   - **File:** glab-mr/SKILL.md:174

2. **F-002** Missing config.json - agent may not be properly configured  
   - **Category:** ASI03

## INFO Findings

1. **F-001** Skill manifest does not include a 'license' field....  
   - **File:** SKILL.md

## OWASP ASI Framework Coverage

- ASI01 Agent Goal Hijack  
- ASI02 Tool Misuse  
- ASI03 Identity & Privilege  
- ASI04 Agentic Supply Chain  
- ASI05 Unexpected Code Execution  
- ASI06 Memory & Context  
- ASI07 Insecure Inter-Agent Communication  
- ASI08 Cascading Failures  
- ASI09 Human-Agent Trust Exploitation  
- ASI10 Rogue Agents

Categories highlighted were detected in this scan. ClawSecure provides comprehensive coverage across all 10 OWASP ASI Top 10 categories.

## Context-Aware Analysis

This skill requests system-level capabilities which are standard for OpenClaw automation skills. ClawSecure's Context-Aware Intelligence analyzes capabilities in ecosystem context. Our 3-Layer Audit Protocol differentiates real threats from normal agent functionality.

## Security Recommendations for gitlab-cli-skills

1. **Pin npm dependencies:** Use exact version numbers in package.json to prevent unauthorized code from entering your dependency tree.
2. **Add a config.json permissions manifest:** Declare what permissions your OpenClaw skill needs for user visibility before installing.
3. **Review shell execution permissions:** Validate that commands are constructed from trusted inputs only.

## Related OpenClaw Security Research

- [Securing the OpenClaw Ecosystem: Your Complete Guide→](/content/blog/securing-the-openclaw-ecosystem/index.html)
- [Understanding Our 3-Layer Audit Protocol→](/content/blog/3-layer-engine/index.html)

## Related Other Security Audits

- [nanobanana-ppt-skills Score 75/100](/content/report/7460f3e1e8316582/index.html)
- [ClawSec Score 45/100](/content/report/ff8ddda64d1f2470/index.html)
- [8ce21d32f8ead424 Score 65/100](/content/report/102bf3f20168381b/index.html)

Scanned on April 30, 2026. gitlab-cli-skills is one of 2,890+ agents audited by ClawSecure from the community-curated awesome-openclaw-skills list.