← Back to Skills Marketplace
6616
Downloads
1
Stars
0
Active Installs
160
Versions
Install in OpenClaw
/install xrowgmbh-gitlab-agent
Description
Operate assigned GitLab work with owner-verified project access and guarded MR delivery.
Usage Guidance
Manual discovery already writes to GitLab. Before enabling recurring operation, make denied projects read-only, resolve collaborators to exact group identities, and restrict project and fork scope. Use a dedicated account with limited permissions and require explicit approval for vulnerability exceptions. The evidence supports Review, without establishing malicious intent or exfiltration.
Capability Assessment
Credentials
GitLab API access and local configuration reads fit the purpose. Subprocess calls use argument arrays; scanner claims of shell injection are unsupported. Variable, release, and MR 55 commands are reference examples. MR creation relies on the documented discovery gate rather than independently enforcing owner authorization.
Install Mechanism
The package uses existing glab authentication and declares glab, jq, and GITLAB_TOKEN. No remote installer, obfuscated payload, or installation-time execution was found. Publisher metadata is empty.
Instruction Scope
SKILL.md claims blanket prior approval and universal reversibility for external actions. It also directs vulnerability-suppression MRs without requiring risk acceptance or expiration. These instructions provide insufficient control over consequential changes.
Persistence & Privilege
The disclosed 15-minute recurring job starts disabled and requires a successful manual run before enabling. Self-merging is disclosed and guarded by assignment, approval-rule, permission, successful pipeline, and commit checks. These safeguards reduce scanner concerns but do not prevent the discovery authorization defects.
Purpose & Capability
GitLab task automation and automatic incident adoption are disclosed. However, list-active-items.py changes workflow labels even after owner authorization fails, and SKILL.md directs daily updates to all forks without limiting them to authorized tasks.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install xrowgmbh-gitlab-agent - After installation, invoke the skill by name or use
/xrowgmbh-gitlab-agent - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.115.1
- Removed `skill-card.md`.
- No changes to `SKILL.md`.
v1.115.0
- Removed `skill-card.md`; no changes to `SKILL.md` were provided.
v1.114.2
- Added configurable collaborator selectors for assigning eligible unassigned issues and tasks; collaborator rules do not affect already-assigned work or incidents.
- Added tests for collaborator handling in active-item discovery.
- Removed the `skill-card.md` file.
v1.114.1
- Removed `skill-card.md`; no changes to `SKILL.md`.
v1.114.0
- Removed the file skill-card.md from the skill package.
- No functional or behavioral changes to the skill logic or usage.
v1.113.1
- Removed the file skill-card.md from the project.
- No changes to the functional logic or documentation content in SKILL.md.
- No new features or bug fixes in this version.
- Maintenance update to remove an unused documentation file.
v1.113.0
- Removed the file: skill-card.md.
- No changes to core functionality or logic.
- Documentation and operational behavior remain unchanged.
- This is a minor maintenance update (documentation cleanup).
v1.112.0
xrowgmbh-gitlab-agent 1.112.0
- Updated core documentation in SKILL.md for improved clarity and guidance.
- Modified reviewer selection script (scripts/select-reviewer.py).
- Adjusted the associated test script (scripts/test_select_reviewer.py).
- Removed the file skill-card.md.
v1.111.0
Version 1.111.0
- Updated scripts and documentation to align with current GitLab agent workflow policies.
- Modified reviewer selection logic in scripts/select-reviewer.py and updated corresponding tests.
- Removed deprecated skill-card.md file.
- Refined and clarified agent assignment and security gate procedures in SKILL.md.
v1.110.1
- Removed the skill-card.md file.
- No user-facing changes to GitLab Agent functionality or documented behavior.
- Documentation cleanup with no impact on existing workflows.
v1.110.0
- Exclude archived projects, projects marked for deletion, and forks during active work discovery in list-active-items.py.
- Updated SKILL.md documentation to describe new project exclusion behavior during discovery.
- Improved incident adoption logic and discovery script behavior.
- Removed outdated skill-card.md file.
v1.109.0
**Security gate logic and helper simplification; redundant scripts removed.**
- Replaced the separate `check-project-access.py` script with integrated access checks and forbidden label gating in `list-active-items.py`.
- The discovery script now performs project access verification and synchronizes the `workflow::forbidden` label.
- Security gate section in documentation updated: clarified process, removed references to the deleted script.
- Retired `check-project-access.py` and related test, streamlining security and queue handling.
- Added a dedicated test for the updated active-items discovery; updated incident handling logic remains in place.
v1.108.1
- Removed the file skill-card.md.
- No changes made to code or logic; documentation file only removed.
- Existing functionality and skill behavior remain unchanged.
v1.108.0
- Added automated claiming of open unassigned incidents in member projects during discovery, with proper labeling and priority mapping.
- Updated discovery logic in scripts/list-active-items.py to support the new incident claim workflow.
- Introduced a new test script: scripts/test_list_active_items_incidents.py to validate incident handling.
- Removed obsolete skill-card.md file.
v1.107.1
- Removed the file skill-card.md.
- Updated documentation in SKILL.md; no functional or behavioral changes to the skill logic indicated.
- Documentation now reflects current usage guidelines, assignment, and security gates.
- No impact on end users or integrations.
v1.107.0
- Removed the file: skill-card.md.
- No changes to functional code or logic; documentation/file structure update only.
v1.106.1
- Removed unused file: skill-card.md.
- Updated SKILL.md for improved Merge Request (MR) creation instructions: now always relate MRs to issues, simplify explicit branch target handling, and clarify MR description requirements.
- Refined process documentation for MR creation fallbacks and project selection.
- No changes to logic; updates are documentation and housekeeping only.
v1.106.0
- Removed the skill-card.md file for cleanup or deprecation.
- No functional logic or behavior changes introduced in this version.
v1.105.1
- Removed the file: skill-card.md
- No changes to core skill logic or behavior
- Documentation now relies exclusively on SKILL.md
v1.105.0
- Removed skill-card.md file from the project.
- No functional or behavioral changes to the skill.
- Documentation or metadata inside SKILL.md remains unchanged.
Metadata
Frequently Asked Questions
What is GitLab Agent?
Operate assigned GitLab work with owner-verified project access and guarded MR delivery. It is an AI Agent Skill for Claude Code / OpenClaw, with 6616 downloads so far.
How do I install GitLab Agent?
Run "/install xrowgmbh-gitlab-agent" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is GitLab Agent free?
Yes, GitLab Agent is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does GitLab Agent support?
GitLab Agent is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created GitLab Agent?
It is built and maintained by xrow GmbH (@xrowgmbh); the current version is v1.115.1.
More Skills