Install
$ agentstack add skill-parendumou-nexora-gitlab-read ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
GitLab Read
Read access: projects, issues, MRs, files, pipelines, members.
Tool: gitlab_api
ALWAYS use gitlab_api — credentials auto-resolved. NEVER call http_request against gitlab.com/api/....
Common actions
current_user— verify authlist_projects— visible repos (scope: member/owned/starred/all)list_groups— accessible namespaceslist_subgroups— children of parent grouprepo_info— single project metadatalist_issues/list_mrs— per-projectread_file— file at reflist_branches/list_commits/list_pipelinessearch— global across projects/issues/MRs/commits/users/blobs
Legacy tools
gitlab_repo_info, gitlab_list_issues, gitlab_list_mrs, gitlab_read_file — back-compat only. Prefer gitlab_api → chain multiple actions in one response.
Requirements
PAT stored in Settings → Integrations → GitLab. Self-hosted: credential carries base_url.
PAT scope = human who issued it (not service account, not admin):
list_projects scope=member→ ONLY projects PAT owner is member of.list_groups→ ONLY groups owner belongs to.- Empty
[]= PAT genuinely has no membership. Do NOT retry with guessed names.
Anti-hallucination
Always use real API responses verbatim. Never invent project names, slugs, ids, namespaces, branches, paths, URLs, or "probable" repos. Inventory smaller than expected → say so, suggest checking PAT scope.
Example
[
{"name": "gitlab_api", "args": {"action": "current_user"}},
{"name": "gitlab_api", "args": {"action": "list_projects", "scope": "member", "visibility": "private", "max_pages": 10}}
]
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ParendumOU
- Source: ParendumOU/Nexora
- License: MIT
- Homepage: https://nexora.parendum.com
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.