Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/knuckles-team/gitlab-api/gitlab-vulnerabilitiesnpx skills add Knuckles-Team/gitlab-api --skill gitlab-vulnerabilitiesgit clone --depth 1 https://github.com/Knuckles-Team/gitlab-apiWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00120 | $0.01262 |
| Opus 5 | $0.00060 | $0.00631 |
| Sonnet 5 | $0.00024 | $0.00252 |
| Haiku 4.5 | $0.00012 | $0.00126 |
Grade A, and why
gitlab-vulnerabilities scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitLab Vulnerabilities
Domain-typed review of a GitLab project's Dependency List and security vulnerabilities — the GitLab equivalent of GitHub's Dependabot dependency/vulnerability review. Covers dependencies at project scope, vulnerabilities at project and group scope, and a single vulnerability by its global ID.
When to use
- Audit a project's dependencies (the Dependency List) — optionally filtered by package manager.
- Review a project's security vulnerabilities (Ultimate).
- Review a group's security vulnerability findings across its projects (Ultimate).
- Fetch one vulnerability by its global
vulnerability_id.
When NOT to use
- Publishing/reading packages in the package registry →
gitlab-packages. - CI/CD pipeline results and job logs →
gitlab-pipelines. - Issues / epics / milestones →
gitlab-issues. - Branch/commit/tag/project reads →
gitlab-repositories.
Prerequisites & environment
Connect via the mcp-client skill against the gitlab-api MCP server.
| Variable | Required | Notes |
|---|---|---|
GITLAB_URL |
✅ | GitLab instance base URL |
GITLAB_TOKEN |
✅ | Access token with api scope; project/group Reporter+ for security data |
GITLAB_SSL_VERIFY |
optional | TLS verification toggle |
VULNERABILITIESTOOL |
optional | Tool-group toggle (defaults True); set False to disable |
Full env/tag matrix: the mcp-client reference agent-tools/mcp-client/references/gitlab-api.md.
MCP_TOOL_MODE (condensed|verbose|both) selects the condensed vs. one-to-one verbose tools.
The Vulnerabilities and findings endpoints require GitLab Ultimate with security scanning enabled. The Dependency List requires a Dependency Scanning job to have run. Without these the endpoints return empty results or
403/404— that is a licensing/config state, not a tool bug.
Tools & actions
| Condensed tool | Actions |
|---|---|
gitlab_vulnerabilities |
dependencies, get_project, get_group, get |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 108 lines · 120 tokens per session scan A c54ed44e229f
gitlab-vulnerabilities is a skill published in the GitHub repository Knuckles-Team/gitlab-api (10 stars, last pushed 3d ago), licensed MIT. It adds 120 tokens to every session and 1,262 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fastapi-guard
Production-ready security middleware for FastAPI. Use when adding IP filtering, rate limiting, per-route security decorators, route-resolution strict mode, global behavior rules, passive/log-only mode, or Guard Agent SaaS telemetry to a FastAPI app. Covers SecurityMiddleware setup, SecurityConfig tuning, and the…
build-and-compile
Building, compiling, and resolving dependency issues across languages.
gdal-api
Use when programming against GDAL/OGR in C, C++, Python, or .NET for raster/vector I/O, coordinate transformation, or custom geospatial algorithms. GDAL API: low-level programming interface for reading/writing 70+ geospatial formats.
go-safe-move-refactor
Safely move Go source files between packages with zero compilation downtime. Handles package declarations, import updates, symbol exports, type renames, test migration, and forwarding stubs. Validates compilation after every atomic step.
go-source-documentation
Add idiomatic, godoc-compliant documentation to Go source and test files. Use when user asks to document Go files, add doc comments, improve Go documentation, or mentions /document-go. Covers file headers, package comments, types, functions, interfaces, constants, variables, tests (with detailed explanations)…
increase-test-coverage
Increase Go test coverage to 90%+ using a Research → Plan → Implement pipeline. Analyzes coverage gaps, generates table-driven tests with httptest mocks, and validates results with go test -coverprofile. Designed for Go MCP server projects using the official go-sdk and gitlab.com/gitlab-org/api/client-go/v2.