How do I install the gitlab-skill: Remove hardcoded corporate URL skill?

Run npx skillmds add tools-only/gitlab-skill-remove-hardcoded-corporate-url in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is gitlab-skill: Remove hardcoded corporate URL safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with gitlab-skill: Remove hardcoded corporate URL?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is gitlab-skill: Remove hardcoded corporate URL free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published gitlab-skill: Remove hardcoded corporate URL?

tools-only (@tools-only) published this skill. Their other Agent Skills are listed on their SkillMD profile.

gitlab-skill: Remove hardcoded corporate URL by tools-only

Name: gitlab-skill: Remove hardcoded corporate URL
Rating: 4.2 (5 reviews)
Author: tools-only

gitlab-skill: Remove hardcoded corporate URL

`validate_glfm.py` lines 152-153 hardcode `https://sourcery.assaabloy.net` as the default GitLab instance URL. `gitlab-ci-local-guide.md` line 51 also references this URL. This leaks a corporate internal URL into a public repository. Replace with a generic placeholder (e.g., `https://gitlab.example.com`) or make the URL a required argument with no default.

tools-only 3740576 3 files · 7.8 KB Updated Sep 9, 2026 7 repo stars

File contents

Groomed (2026-02-24)

Reproducibility

Original problem (pre-fix):

Open plugins/gitlab-skill/skills/gitlab-skill/scripts/validate_glfm.py lines 152–153 — default --gitlab-url was https://sourcery.assaabloy.net
Open plugins/gitlab-skill/skills/gitlab-skill/references/gitlab-ci-local-guide.md line 51 — example URL referenced same corporate host

Verification (post-fix):

rg "sourcery\.assaabloy\.net" plugins/gitlab-skill returns no matches
Both locations use https://gitlab.example.com

Output / Evidence

Commit: 103cbf6c2d1e865bdd6afdef6e3d5912ff7bab2b — fix(gitlab-skill): replace hardcoded corporate URL with generic placeholder
Files changed: validate_glfm.py (default arg + help text), gitlab-ci-local-guide.md (example URL), plugin.json, marketplace.json, BACKLOG.md
Fact-check: All three claims verified (validate_glfm.py, gitlab-ci-local-guide.md, fix applied)

Priority

8/10 — Corporate URL in a public repo is a security/privacy leak; affects all contributors and downstream users.

Impact

Before: Internal corporate host exposed in public code
After: Generic placeholder; no internal infrastructure exposed

Benefits

Public repo no longer exposes internal URLs
Script and docs use generic placeholder suitable for any GitLab instance
--gitlab-url remains optional with a safe default

Expected Behavior

validate_glfm.py --gitlab-url defaults to https://gitlab.example.com (or equivalent generic placeholder)
Documentation examples use generic URLs, not internal hosts

Desired Structure

Default URL: generic placeholder (e.g., https://gitlab.example.com)
Alternative: make --gitlab-url required with no default
Chosen approach: generic placeholder (keeps backward compatibility)

Acceptance Criteria

validate_glfm.py lines 152–153 use https://gitlab.example.com as default
gitlab-ci-local-guide.md line 51 uses https://gitlab.example.com in examples
No references to sourcery.assaabloy.net remain in the repo

Resources

Type	Item
Skill	gitlab-skill (`plugins/gitlab-skill/skills/gitlab-skill/`)
Skill	glab-cli-ci-debugging (Cursor skill for GitLab CI debugging)
Agent	@plugin-assessor (gitlab-skill audit)
Prior work	completed-replace-requests-with-httpx-in-all-scripts — validate_glfm.py migrated to httpx
Prior work	ideas-gitlab-skill-gitlab-ci-glfm-validation-mcp — MCP wrapper for validate_glfm
Commit	103cbf6

Effort

Small — two locations updated in a single commit.

---name: gitlab-skill-remove-hardcoded-corporate-urldescription: `validate_glfm.py` lines 152-153 hardcode `https://sourcery.assaabloy.net` as the default GitLab instance URL. `gitlab-ci-local-guide.md` line 51 also references this URL. This leaks a corporate internal URL into a public repository. Replace with a generic placeholder (e.g., `https://gitlab.example.com`) or make the URL a required argument with no default.--- ## Groomed (2026-02-24) ### Reproducibility **Original problem (pre-fix):** 1. Open `plugins/gitlab-skill/skills/gitlab-skill/scripts/validate_glfm.py` lines 152–153 — default `--gitlab-url` was `https://sourcery.assaabloy.net` 2. Open `plugins/gitlab-skill/skills/gitlab-skill/references/gitlab-ci-local-guide.md` line 51 — example URL referenced same corporate host **Verification (post-fix):** 1. `rg "sourcery\.assaabloy\.net" plugins/gitlab-skill` returns no matches 2. Both locations use `https://gitlab.example.com` ### Output / Evidence - **Commit**: 103cbf6c2d1e865bdd6afdef6e3d5912ff7bab2b — `fix(gitlab-skill): replace hardcoded corporate URL with generic placeholder` - **Files changed**: `validate_glfm.py` (default arg + help text), `gitlab-ci-local-guide.md` (example URL), `plugin.json`, `marketplace.json`, `BACKLOG.md` - **Fact-check**: All three claims verified (validate_glfm.py, gitlab-ci-local-guide.md, fix applied) ### Priority 8/10 — Corporate URL in a public repo is a security/privacy leak; affects all contributors and downstream users. ### Impact - **Before**: Internal corporate host exposed in public code - **After**: Generic placeholder; no internal infrastructure exposed ### Benefits - Public repo no longer exposes internal URLs - Script and docs use generic placeholder suitable for any GitLab instance - `--gitlab-url` remains optional with a safe default ### Expected Behavior - `validate_glfm.py --gitlab-url` defaults to `https://gitlab.example.com` (or equivalent generic placeholder) - Documentation examples use generic URLs, not internal hosts ### Desired Structure - Default URL: generic placeholder (e.g., `https://gitlab.example.com`) - Alternative: make `--gitlab-url` required with no default - Chosen approach: generic placeholder (keeps backward compatibility) ### Acceptance Criteria 1. [x] `validate_glfm.py` lines 152–153 use `https://gitlab.example.com` as default 2. [x] `gitlab-ci-local-guide.md` line 51 uses `https://gitlab.example.com` in examples 3. [x] No references to `sourcery.assaabloy.net` remain in the repo ### Resources | Type | Item | |------|------| | Skill | gitlab-skill (`plugins/gitlab-skill/skills/gitlab-skill/`) | | Skill | glab-cli-ci-debugging (Cursor skill for GitLab CI debugging) | | Agent | @plugin-assessor (gitlab-skill audit) | | Prior work | [completed-replace-requests-with-httpx-in-all-scripts](completed-replace-requests-with-httpx-in-all-scripts.md) — validate_glfm.py migrated to httpx | | Prior work | [ideas-gitlab-skill-gitlab-ci-glfm-validation-mcp](ideas-gitlab-skill-gitlab-ci-glfm-validation-mcp.md) — MCP wrapper for validate_glfm | | Commit | 103cbf6 | ### Effort Small — two locations updated in a single commit.

Frequently asked questions