agentleFS
Sign inStart free
IgorGanapolskyIgorGanapolsky/ThumbGate/.agents/skills/gitlab-sandbox-allowlist-not-trust/SKILL.md

gitlab-sandbox-allowlist-not-trust

Skill29 starsChanged 7 months agoMITView on GitHub

GitLab 2026-09 FORMAT steal: sandbox allowlists are hops, not trust boundaries. Audit package-registry/proxy/HF destinations and trust-handoff writes on existing ThumbGate egress rails. Never clone GitLab Duo. Slash: /gitlab-sandbox-allowlist-not-trust.

We split this skill into the rules it gives an agent

1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈0

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Keep observe→draft from promoting package proxies onto allowHosts.

    line 65

≈ “Common” is an estimate: at least 1 in 5 of the 308,232 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

GitLab sandbox allowlist ≠ trust

Goal

Produce fail-closed honesty for whom: ThumbGate agents treating deny-network-egress / agent-egress-policy allowlists as sandbox containment — so a permitted package proxy cannot silently become the escape hop GitLab documented.

Constraints

NEVERALWAYS
Clone GitLab Duo Agent Platform / execution sandbox SKUClassify registry/proxy/HF hosts as bridge
Treat allowlisted registry.npmjs.org as trustedIndependent auth before credentials ride a hop
Auto-promote observed proxy traffic onto allowHostsPut bridge hosts on bridgeHosts only
Claim hook/CI/MCP writes are sandbox-containedCall them trust-handoff
Dual-edit untracked scripts/gitlab-ai-sandbox-integration.jsUse this doctor + existing egress policy
Hero Continuity / net-new governance SKUMap onto PreToolUse + agent-egress-policy

HARD fail closed. REFUSE SKU clones. ECI: maintenance of existing egress rails only.

Reference

Examples (show, don't tell)

Weak: Summarize GitLab Duo and add a container sandbox class.

Gold:

$ npx thumbgate@1.36.1 allowlist-bridge-honesty --json
allowlistIsTrustBoundary: false
$ node --test tests/allowlist-bridge-honesty.test.js
# Authorization to registry.npmjs.org → ALLOWLIST_BRIDGE_CREDENTIAL deny

Procedures

npx thumbgate@1.36.1 allowlist-bridge-honesty --json
npx thumbgate@1.36.1 allowlist-bridge-honesty --allow-hosts=registry.npmjs.org --treat-allowlist-as-trust --json
npx thumbgate@1.36.1 allowlist-bridge-honesty --write=.github/workflows/ci.yml --claimed-contained --json
npm run test:allowlist-bridge-honesty
  1. Classify every allowlisted host (bridge vs public vs ssrf_private).
  2. Deny credentialed requests to bridge hops unless independentAuth is already granted.
  3. Keep observe→draft from promoting package proxies onto allowHosts.
  4. Label privileged-consumer writes as trust-handoff.
  5. Refuse --clone-gitlab-duo.

Rubric

  • gold fixture (this repo default gate) → ok=true, allowlistIsTrustBoundary=false
  • --treat-allowlist-as-trust with npm registry → ok=false
  • --clone-gitlab-duo → ok=false
  • observe draft of registry.npmjs.org → not in allowHosts
  • Authorization to allowlisted npm → ALLOWLIST_BRIDGE_CREDENTIAL
  • doctor: npm run test:allowlist-bridge-honesty PASS
  • evidence: command output in the same turn

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free