Skip to main content
{ Vulnerability Management / Application Security }

GitLab Repository Code Vulnerability Detection

Finds exploitable vulnerabilities in a GitLab repository's own code, and verifies each one against the source before reporting it.

What this agent does

This read-only agent looks for security vulnerabilities in the code a team writes, not in its dependencies. It maps the repository's projects and decides which vulnerability types fit each one, such as SQL injection and broken authorization in a backend, or XSS in a frontend. It picks the files most likely to contain each type and analyzes them. It then runs a second, independent check that confirms or rejects every finding against the source code.

The challenge

Pattern-based code scanners report every query built from a string and every unescaped output, whether or not an attacker can reach it. The findings that matter most, such as broken object-level authorization or a workflow a user can skip, have no simple pattern at all. Engineers spend their review time on false positives and still miss the logic flaws.

The solution

The agent reads the code the way a security reviewer would. It plans the review around what each project is, and it reports a finding only when the finding meets specific criteria. In a separate verification pass, it looks for mitigations it did not account for the first time, such as framework escaping, ORM parameterization, or route-level authorization. Provides a short list of verified vulnerabilities, each with the file, the line, the attack path, and the fix.

Workflow

  1. 01

    Map the repository

    Identify each project in the repository and whether it is a backend, frontend, mobile app, or library.

  2. 02

    Plan the review

    Choose the vulnerability types that apply to each project, and pick the files most likely to contain each one.

  3. 03

    Analyze

    Check each candidate file against the criteria for its vulnerability type, and record the evidence.

  4. 04

    Verify

    Independently confirm each finding against the source, check for missed mitigations, and reject what does not hold.

  5. 05

    Report

    List verified vulnerabilities with file, line, attack path, and fix, then the rejected findings and why.

Agent template 

# GitLab Repository Code Vulnerability Detection

## Measurable outcomes

Every finding in the report has been verified against the source code, with the file, the line, the attack path, and a recommended fix. Every rejected finding has a reason. Track the verified and rejected counts on every run.

## Procedure

For a given repository, map its projects first and note whether each one is a backend, frontend, mobile app, or library. The [ghost-repo-context](https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/repo-context) skill in the [Ghost skills repository](https://github.com/ghostsecurity/skills) builds this map. Plan the review from it, and pick the vulnerability types that fit each project. For backends, that means injection, broken authorization such as BOLA and BFLA, authentication flaws, SSRF, unsafe deserialization, file handling, and business logic flaws. For frontends, it means XSS, token handling, and client-side data exposure. For libraries, it means prototype pollution, unsafe deserialization, ReDoS, path traversal, and zip slip. For each type, pick the files most likely to contain it, then check each file against the criteria for that type and record the evidence. Report a finding only when the vulnerable code exists at the reported line, an attacker can reach it, and nothing in the path stops the attack. Then verify every finding separately. Confirm the code and line, re-check each criterion, and look for mitigations the first pass missed, such as framework escaping, ORM parameterization, validation middleware, or authorization applied at the route. Reject any finding that does not hold, and say why. Work only from the repository, never from the internet. Let me choose how deep a review to run, since a full review costs far more than a quick one. The [ghost-scan-code](https://github.com/ghostsecurity/skills/tree/main/plugins/ghost/skills/scan-code) skill is a working reference for this whole process.

## Requirements

It needs GitLab read access to the repository, and nothing more. It never changes the repository, and it never runs the repository's code.