Verified:GitHub

gitlab-public-recon

Enumerate public GitLab projects and extract sensitive configuration files and CI/CD variables.

3|1|Updated Jul 2, 2026

Search Tags:#ci/cd #security #secrets #gitlab #enumeration #recon

One-click install

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill gitlab-public-recon-entrovyx

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: gitlab-public-recon
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/gitlab-public-recon
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill gitlab-public-recon-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, python3, jq.

What problem does it solve?

This skill addresses the security risk of publicly exposed GitLab instances that inadvertently leak sensitive development infrastructure, credentials, and internal configuration files.

Core Features & Use Cases

Automated Enumeration: Quickly identify public projects and repositories on a target GitLab instance.
Sensitive Data Hunting: Automatically scan for environment files, CI/CD configurations, and hardcoded secrets.
Use Case: When performing an external security assessment, use this skill to verify if a client's self-hosted GitLab instance is leaking internal IP addresses or deployment tokens that could lead to further exploitation.

Quick Start

Run the gitlab-public-recon skill against the target domain gitlab.example.com to identify exposed repositories and sensitive configuration files.

Frequently Asked Questions about gitlab-public-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I enumerate public GitLab projects for exposed CI/CD variables and secrets?▼

You can enumerate public GitLab projects and extract sensitive configuration files by running this skill against a target domain. It performs automated API-based discovery to hunt for environment files, CI/CD variables, and hardcoded secrets.

What is GitLab reconnaissance for offensive security assessments?▼

GitLab reconnaissance is the process of discovering public projects and extracting internal infrastructure details like deployment tokens. It identifies sensitive development configurations inadvertently leaked on self-hosted or public GitLab instances during external security assessments.

Do I need curl and jq installed to scan self-hosted GitLab instances?▼

Yes, you need curl, python3, and jq installed to scan self-hosted GitLab instances. These dependencies are required to perform API-based discovery, query projects, and parse the extracted data for sensitive configuration files.

Can I use this to find leaked infrastructure details and deployment tokens?▼

Yes, you can use this to find leaked infrastructure details and deployment tokens. It automatically scans public repositories to identify exposed internal IP addresses, CI/CD configurations, and credentials that could lead to further exploitation.

What's the best way to extract sensitive configuration files from public GitLab repositories?▼

The best way to extract sensitive configuration files from public GitLab repositories is using automated API-based discovery. This approach systematically identifies public projects and parses their configurations to uncover hardcoded secrets and environment variables.