gitlab-readonly-live
Use this skill for current live data from the GitLab projects listed in
$GITLAB_READONLY_PROJECTS.
Access model
- The allowlist may contain multiple comma-separated projects.
- If there is one project, the helper selects it automatically. With multiple
projects, pass
--project group/project explicitly.
- Requests use the OpenShell provider placeholder from
GITLAB_TOKEN. Never
print or inspect that variable or any .env file.
- Access is limited to GET requests for issues, merge requests, repository
content and history, labels, milestones, and releases. Bare project metadata
is excluded because GitLab may include sensitive fields for privileged users.
- Authenticated-user metadata is also excluded because GitLab's current-user
response can contain private identity, email, sign-in, and network details.
- Membership, CI/CD variables, hooks, deploy tokens, runners, and every write
method are outside policy.
- Do not use
glab, git, alternate GitLab hosts, GraphQL, or custom requests.
Procedure
Always invoke the bundled helper:
/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get issues --param state=opened --paginate --count
/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get merge_requests --param state=opened --paginate --fields iid,title,state,web_url
/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get repository/tree --param recursive=true --paginate --limit 50 --fields name,path,type
Add --project group/project to any get command when more than one project is
configured. Put query parameters in --param KEY=VALUE, not in the route. Use
%2F for slashes inside a repository file-path segment, for example
repository/files/docs%2Fguide.md.
If OpenShell returns a policy 403, report the configured project and route
scope. Do not retry through a different host, binary, or endpoint.
1---2name: gitlab-readonly-live3description: Read one of the configured GitLab projects through authenticated, policy-scoped REST GET requests.4---56# gitlab-readonly-live78Use this skill for current live data from the GitLab projects listed in9`$GITLAB_READONLY_PROJECTS`.1011## Access model1213- The allowlist may contain multiple comma-separated projects.14- If there is one project, the helper selects it automatically. With multiple15 projects, pass `--project group/project` explicitly.16- Requests use the OpenShell provider placeholder from `GITLAB_TOKEN`. Never17 print or inspect that variable or any `.env` file.18- Access is limited to GET requests for issues, merge requests, repository19 content and history, labels, milestones, and releases. Bare project metadata20 is excluded because GitLab may include sensitive fields for privileged users.21- Authenticated-user metadata is also excluded because GitLab's current-user22 response can contain private identity, email, sign-in, and network details.23- Membership, CI/CD variables, hooks, deploy tokens, runners, and every write24 method are outside policy.25- Do not use `glab`, `git`, alternate GitLab hosts, GraphQL, or custom requests.2627## Procedure2829Always invoke the bundled helper:3031```bash32/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get issues --param state=opened --paginate --count33/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get merge_requests --param state=opened --paginate --fields iid,title,state,web_url34/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get repository/tree --param recursive=true --paginate --limit 50 --fields name,path,type35```3637Add `--project group/project` to any `get` command when more than one project is38configured. Put query parameters in `--param KEY=VALUE`, not in the route. Use39`%2F` for slashes inside a repository file-path segment, for example40`repository/files/docs%2Fguide.md`.4142If OpenShell returns a policy 403, report the configured project and route43scope. Do not retry through a different host, binary, or endpoint.
NVIDIA