| name | gitlab-readonly-live |
| description | Read one of the configured GitLab projects through authenticated, policy-scoped REST GET requests. |
gitlab-readonly-live
Use this skill for current live data from the GitLab projects listed in
$GITLAB_READONLY_PROJECTS.
Access model
- The allowlist may contain multiple comma-separated projects.
- If there is one project, the helper selects it automatically. With multiple
projects, pass
--project group/project explicitly.
- Requests use the OpenShell provider placeholder from
GITLAB_TOKEN. Never
print or inspect that variable or any .env file.
- Access is limited to GET requests for issues, merge requests, repository
content and history, labels, milestones, and releases. Bare project metadata
is excluded because GitLab may include sensitive fields for privileged users.
- Authenticated-user metadata is also excluded because GitLab's current-user
response can contain private identity, email, sign-in, and network details.
- Membership, CI/CD variables, hooks, deploy tokens, runners, and every write
method are outside policy.
- Do not use
glab, git, alternate GitLab hosts, GraphQL, or custom requests.
Procedure
Always invoke the bundled helper:
/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get issues --param state=opened --paginate --count
/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get merge_requests --param state=opened --paginate --fields iid,title,state,web_url
/usr/bin/python3 /sandbox/.hermes-data/skills/gitlab-readonly-live/scripts/gitlab_readonly.py get repository/tree --param recursive=true --paginate --limit 50 --fields name,path,type
Add --project group/project to any get command when more than one project is
configured. Put query parameters in --param KEY=VALUE, not in the route. Use
%2F for slashes inside a repository file-path segment, for example
repository/files/docs%2Fguide.md.
If OpenShell returns a policy 403, report the configured project and route
scope. Do not retry through a different host, binary, or endpoint.
