The 145 external-command detections are false positives caused by Markdown backticks, and both reconnaissance detections describe normal GitLab validation or filtering. The skill intentionally connects to Rube MCP, delegates GitLab OAuth access, and permits remote mutations without an explicit confirmation step.
The workflows create or update issues, projects, and branches without requiring confirmation before state changes. Agent errors could alter shared GitLab resources.
The cited workflow steps explicitly invoke issue updates, project creation, and branch creation, while no nearby step requires user confirmation.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
Line 21 directs users to configure the external Rube MCP endpoint, creating an intentional network and third-party trust dependency. This expected integration remains a real data-access boundary.
Most static external command findings are false positives caused by Markdown inline code references to GitLab and Rube MCP tool names. The skill relies on an external MCP endpoint and describes state-changing GitLab operations, so users should review permissions and confirm writes. No evidence of prompt injection, obfuscation, or secret exfiltration was found.
State-Changing GitLab Operations Through External MCP
The skill guides agents to create projects, create branches, and update issues through Rube MCP after GitLab OAuth. These actions can modify repository and project state if executed without explicit user confirmation.
The setup and workflow lines explicitly route GitLab operations through Rube MCP and include project, branch, and issue write actions. The risk is permission misuse or unintended state change, not hidden malicious code.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
The skill instructs users to add https://rube.app/mcp as an external MCP server. This is a legitimate documented dependency, but it creates a network trust boundary for GitLab OAuth and API operations.
The static analyzer misclassified Markdown inline code spans as Ruby shell backtick execution across the GitLab workflow documentation. The only confirmed issue is a disclosed external Rube MCP endpoint, which is a low-risk third-party network dependency rather than hidden or malicious behavior.
1
Files scanned
255
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
Line 20 instructs users to configure https://rube.app/mcp as an MCP server. This is an intentional third-party network dependency, which expands the trust boundary even though it is disclosed.
The static analyzer misclassified Markdown inline code spans as Ruby shell backtick execution across the GitLab workflow documentation. The only confirmed issue is a disclosed external Rube MCP endpoint, which is a low-risk third-party network dependency rather than hidden or malicious behavior.
1
Files scanned
255
Lines analyzed
3
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k
Line 20 instructs users to configure https://rube.app/mcp as an MCP server. This is an intentional third-party network dependency, which expands the trust boundary even though it is disclosed.
Static analysis reported many Ruby backtick and weak-crypto indicators, but the reviewed file is markdown documentation and the backticks are inline tool names, parameters, and examples. No prompt injection attempt or malicious exfiltration intent was found. The real risk is operational: the skill guides authenticated GitLab actions through Rube MCP, including issue creation, project creation, branch creation, and user lookup, so it should publish with a clear external-service and write-action warning.
Authenticated GitLab Write Operations Through External MCP
The skill instructs users to connect Rube MCP to GitLab and use tools that can create projects, create branches, create issues, and update issues. This is legitimate for a GitLab automation skill, but mistakes or overbroad prompts could modify live GitLab data using the user authorized account.
The referenced lines explicitly require Rube MCP GitLab authorization and list write-capable GitLab tools. The behavior is expected for the skill, but it still creates live operational risk.
The setup directs users to add the Rube MCP endpoint and complete GitLab OAuth through that service. This introduces a third-party service dependency for authenticated GitLab operations and should be disclosed to users.
Line 20 directly names the external MCP URL and the surrounding setup describes GitLab OAuth. The evidence supports a disclosure concern, not a finding of malicious exfiltration.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Backtick Command Execution Findings Are Markdown False Positives
The static analyzer flagged many Ruby shell backtick findings. Review found markdown inline code for Rube tool names, GitLab parameters, and examples rather than executable Ruby or shell code.
The file is SKILL.md documentation, and the flagged backticks surround tool slugs and parameter names. No executable Ruby source or shell command invocation is present in the reviewed file.
Weak Cryptography Findings Are Identifier Text False Positives
The static analyzer flagged weak cryptographic algorithm terms on several lines, but review found frontmatter, GitLab field names, search parameters, member listing text, and issue creation documentation. No cryptographic implementation is present.
The reviewed lines are frontmatter or GitLab parameter descriptions, not code that selects cryptographic algorithms. The skill contains no crypto routines.
System Reconnaissance Findings Are GitLab Metadata Queries
The analyzer reported reconnaissance on lines that describe branch verification and CI pipeline filters. These are normal GitLab workflow queries and do not inspect the local host system.
The lines describe validating GitLab branch references and filtering invalid pipeline configurations. They do not collect local machine, OS, or environment data.
This skill is Markdown documentation for GitLab automation via Rube MCP (Composio). All 301 static analyzer 'external_commands' findings are FALSE POSITIVE - the detected backticks are Markdown code formatting (e.g., `RUBE_SEARCH_TOOLS`), not Ruby shell execution. The single 'network' finding is documentation instructing users to configure an MCP endpoint, not actual network code. No executable code present - this is a documentation-only skill with no security risks.
1
Files scanned
260
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.