Check G18 · agent surface family · severity HIGH · automatic · one of the 22 GitLab checks
The question this check asks: does this gitlab.com project ship files that an AI coding agent will load at the start of a session and obey — before you have read them, and with no visual difference from anything a developer wrote?
CLAUDE.md, AGENTS.md, .cursorrules, .cursor/rules/*.mdc, .clinerules, .windsurfrules, .github/copilot-instructions.md, and the MCP and settings files under .mcp.json, .cursor/ and .claude/ are auto-loaded at session start and treated with near-system-prompt authority. The Cloud Security Alliance's ReadSecBench measured what that means: direct commands planted in repository text succeeded about 84% of the time, instructions two hops removed about 91%, and 93% of human reviewers missed the embedded attacks. The standard's rule is one line — fetch and read those files before starting an agent in the directory — and this check exists to tell you which files that means.
On gitlab.com one of those readers is built into the host. GitLab Duo reads AGENTS.md from the project root and its subdirectories — in Duo Chat since GitLab 18.7, in flows and generally available in 18.8, in the GitLab UI from 18.11, on Premium and Ultimate with the Duo add-on — and its documentation carries no warning about untrusted projects. That is why GitLab's own projects carry one, and why on this platform the file is read not only by the agent on your machine but by the platform's own assistant, inside the project's own pages.
G18 lists the project's tree in one call — GET /projects/:id/repository/tree?recursive=true&per_page=10000, with :id the URL-encoded path, gitlab-org%2Fgitlab-runner — and, for each agent file the tree names, fetches the contents through the files API, /repository/files/:path/raw: at most eight agent files and four devcontainer configurations a scan. It is the same check as C18, the same code, on a snapshot built from gitlab.com's API instead of GitHub's. Each file is a row at severity HIGH with the note “auto-loaded by AI coding agents at session start — read before agent-ing”, and each row costs 0 points. The evidence note in the scoring table:
“77/80 top repos ship CLAUDE.md/AGENTS.md in 2026 — presence is not signal”
Measured on 19 September 2026 across the 100 most-starred gitlab.com projects, anonymously, through the same code as /v1/gl/score: the row fired on 18 — AGENTS.md on 16, CLAUDE.md on 11, .claude/settings.json on 3 — and on six of the 100 it was the only finding standing between the project and PASS. GitHub's 100 most-starred, run through the same engine the same day as a control, fired it on 48. gitlab-org/gitlab-runner is the GitLab example: REVIEW, driven by its AGENTS.md.
That produces a result worth explaining rather than hiding. Because the verdict follows the most severe row, a project whose only finding is G18 reads REVIEW on the board — with a score of 100, and with the default personal policy set to allow, so the download proceeds and no decision page appears. The standard says read the file; the policy says it will not cost you the download; the board shows both. The weight lives in the three checks that read what is inside those files: G19 hidden Unicode (45 points, blocks), G20 MCP shell launch (30 points) and G21 credential redirect (30 points) — and on the 100 gitlab.com projects all three fired zero times.
Not applicable in the usual sense — the row fires on every project that has such a file, and the weight was set to zero when the Phase 0 controls found 77 of the 80 most popular GitHub repositories shipping one; before that, a HIGH-weighted presence row was pure noise that would have put a warning on React. gitlab.com's top-100 carries fewer — 18 against the GitHub control's 48 — but the file is no more a signal there than on GitHub, and with Duo reading AGENTS.md it is GitLab's own projects that ship it. The row is a pointer to something you should read, on either platform.
It reads the files on its list. A README that tells an agent what to do in plain prose — the ReadSecBench numbers above are about READMEs — is not an agent config file and is not read here. GitLab Duo's own customisation files — .gitlab/duo/chat-rules.md, .gitlab/duo/mr-review-instructions.yaml, a skills/<name>/SKILL.md — are not on the list yet and are not read until an update adds them; a user-level ~/.gitlab/duo/AGENTS.md is outside the project and never seen, as is your agent's own global configuration. A project whose tree the API does not answer — one of the 100, spacecowboy/Feeder — has G10 to G21 listed as not checked, not passed. And presence is all this row reports: what the files say is the job of G19, G20 and G21, and a file that contains a harmful instruction in ordinary visible text passes all three — the standard's advice to read them is not replaced by any check.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. On gitlab.com the board and the download gate are a later, separate store release: today the verdict on a gitlab.com project is served by the API and the MCP server, and it reads the file before any download — it does not see the agent read it.
RepoGates runs the same 22 checks on a gitlab.com project that it runs on a GitHub repository, from gitlab.com's public API, under the key gl/{namespace…}/{project}. What that API withholds from an anonymous caller — fork status, a user namespace's account age, and OpenSSF Scorecard, which does not cover gitlab.com — is listed as not checked, never assumed. A self-managed GitLab is another hostname and is not assessed. The repository's code is not read on this tier: a PASS means the provenance and the declared execution surface are clean.
Without installing anything: look at the root of the project on gitlab.com and at .cursor/, .claude/ and .github/ for the names above, and read each one in full before you open an agent in the directory. From a terminal, through the same two API calls the check makes — the project path is URL-encoded, so every / in a nested group path becomes %2F:
P='gitlab-org%2Fgitlab-runner'
REF=$(curl -s "https://gitlab.com/api/v4/projects/$P" | jq -r .default_branch)
curl -s "https://gitlab.com/api/v4/projects/$P/repository/tree?recursive=true&per_page=10000&ref=$REF" \
| jq -r '.[].path' | grep -E '^(CLAUDE\.md|AGENTS\.md|\.cursorrules|\.clinerules|\.windsurfrules|\.github/copilot-instructions\.md|\.cursor/rules/.*\.mdc|\.mcp\.json|\.cursor/mcp\.json|\.claude/.*\.json)$'
curl -s "https://gitlab.com/api/v4/projects/$P/repository/files/AGENTS.md/raw?ref=$REF"Then read them the way you would read a shell script someone handed you: as instructions that will be followed. If your agent supports disabling project-scoped configuration until you trust the folder, turn that on. Anonymous gitlab.com allows 500 requests a minute from one address; these three are well inside it.
Why does the board show REVIEW with a score of 100? Because the standard and the policy disagree on purpose, on gitlab.com exactly as on GitHub. The vetting standard grades an agent instruction file HIGH: read it before you start an agent in the directory. The scoring table weighs its presence at 0 points — 77 of the 80 most popular GitHub repositories in the Phase 0 controls ship one, and GitLab Duo reads AGENTS.md by design — and the default policy lets the download proceed. A project whose only finding is G18 therefore reads REVIEW at 100 on the board, and the gate does not stop it; six of the 100 most-starred gitlab.com projects are REVIEW for this finding alone.
So what is the finding for? It names the files, so you know what an agent will read before you do, and it is the input to three checks that read the contents: hidden Unicode, an MCP configuration that launches a shell fetch, and a credential redirect. Those three carry the weight — 45, 30 and 30 points. On the 100 most-starred gitlab.com projects the pointer fired 18 times and the three content checks not once. Presence is the pointer; content is the signal.
Does RepoGates stop git clone? No. RepoGates gates browser-initiated downloads, and on gitlab.com the board and the download gate are a later, separate store release: today a gitlab.com project's verdict is served by the API and the MCP server. It does not see git clone, package managers, curl, or fetches made by AI agents outside the browser — and it does not see the agent read the file; it sees the file before the download.
C18 Agent config files — the GitHub original · G19 Hidden Unicode — what is inside the file that a reviewer cannot see · G20 MCP shell-launch config — a command in the file that fetches and runs · G22 AI-agent provenance — a project carrying instructions for an agent, and recommended by one.
Add RepoGates to Chrome Pricing
Numbers on this page: Cloud Security Alliance, ReadSecBench (success and reviewer-miss rates, as cited in the repository vetting standard); Phase 0 controls of 14 August 2026 (77 of 80 popular GitHub repositories); the 100 most-starred gitlab.com projects and GitHub's 100 most-starred as a control, both measured 19 September 2026 through the same engine; GitLab's documentation for AGENTS.md in GitLab Duo; weights and actions from the product's scoring and policy tables.