Verified:GitHub

xhgj-gitlab-collaboration

Executes controlled GitLab Issue, Note, Discussion, and MR operations with preflight checks and full readback.

Updated Jun 8, 2026

Search Tags:#issue tracking #gitlab #merge request #preflight #glab #timelog #fail-closed

One-click install

npx skills add https://github.com/SilentFlower/flower-trellis --skill xhgj-gitlab-collaboration-silentflower

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: xhgj-gitlab-collaboration
Source: https://github.com/SilentFlower/flower-trellis/tree/main/.agents/skills/xhgj-gitlab-collaboration
Command: npx skills add https://github.com/SilentFlower/flower-trellis --skill xhgj-gitlab-collaboration-silentflower

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Acting on a company GitLab instance through an AI assistant risks wrong targets, leaked credentials, inconsistent writes, and unverifiable results. This Skill enforces a fail-closed workflow for low-impact GitLab collaboration so every write is authorized, frozen, and verified by full readback. ## Core Features & Use Cases - Layered preflight checks: Separates API-only actions (Issue, Note, Discussion Reply) from repo actions (branch, push, MR) with secret-free live checks of glab identity, project access, remotes, and commit identity. - Structured write operations: Creates or updates Issues, top-level Notes, Discussion Replies, Issue Links, and MRs with frozen UTF-8 payloads, real object ID readback, and pipeline/mergeability queries. - Confirmed work-time logging: Records issue work hours only via GraphQL timelogCreate after explicit user confirmation, with three-way readback verification. - Use Case: You ask the assistant to create a GitLab MR from your current branch. The Skill runs repo-mode preflight, freezes the payload with explicit source/target and an assignee, creates the MR, then reads back the real MR ID and fields before reporting success. ## Quick Start Ask the assistant to use the xhgj-gitlab-collaboration skill to check glab identity and project permissions, then create a GitLab Issue with a frozen Chinese-language description and read back the result.

Frequently Asked Questions about xhgj-gitlab-collaboration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I safely create GitLab Issues and MRs with an AI assistant?▼

Run the layered preflight first: api mode for Issue and Note actions, repo mode for branch and MR actions. Then freeze the full payload, execute only authorized writes, and read back the real object ID and full fields before reporting success.

What is the difference between api and repo preflight modes in glab workflows?▼

API mode only verifies glab identity and target project readability for API-only actions like Issues and Notes. Repo mode additionally checks the origin remote, current branch, ahead/behind state, working tree, and commit name/email for branch, push, and MR operations.

Can this Skill merge MRs or manage GitLab permissions?▼

No. It never executes merge, auto-merge, deletions, closures, or permission and membership changes. It only reads pipeline and mergeability status; merging remains a human action, and results are verified by reading back squash_commit_sha.

How does GitLab work-time logging work with timelogCreate?▼

Work hours are written only through the GraphQL timelogCreate mutation after the user explicitly confirms duration, date, and summary. Success requires three-way readback of the mutation echo, REST time_stats, and GraphQL timelogs; quick actions like /spend are never sent.

Why does the Skill stop when a GitLab write cannot be read back?▼

A write that cannot be fully read back is treated as unknown, never as success, and is never automatically resent. This fail-closed rule prevents duplicate objects and unverifiable state when responses are ambiguous or fields mismatch.

Does this Skill handle GitLab tokens or credentials?▼

No. It never requests, reads, logs, or forwards PATs, OAuth tokens, cookies, or credential helper output, and never embeds credentials in remote URLs or command arguments. Authentication is entirely delegated to the user's existing glab setup.