AI coding tools are incredible. But I noticed something — they ship code fast, skip the rules, and nobody catches it until it's already in production. That's exactly what GuardDuo is built to fix.
We're in the age of vibe-coding. You describe what you want, the AI builds it, it works — and you ship it. But "works" and "correct" are two very different things.
Imagine asking an AI to build a login form. It works perfectly. But under the hood it has hardcoded API keys, no input validation, missing aria-labels
, and it's using fetch
directly instead of your project's apiClient
wrapper. Your Issue said none of that was allowed. Nobody caught it.
That's the vibe-coding trap — and it's happening on every team using AI-assisted development right now.
GuardDuo is a GitLab Duo Agent skill that acts as your AI guardian. Instead of just reviewing code in isolation, it cross-references your code changes against the actual intent of the linked GitLab Issue — using the Orbit Knowledge Graph, which is essentially the brain that knows your project's rules, requirements, and success criteria.
In plain terms: GuardDuo reads what the Issue asked for, reads what the code actually does, and tells you exactly where they don't match.
It audits across three dimensions:
alt
text, aria-labels
, poor color contrastAnd when it finds a problem, it doesn't just flag it — it fixes it.
Just open GitLab Duo Chat or GitLab Agent Platform(on your choice of IDE) -> choose the agent as GuardDuo and type:
Audit issue #[issue no.]
— GuardDuo pulls the Issue context from Orbit, analyzes the code, and returns a structured reportFix issue #[issue no.]
— GuardDuo generates a corrected implementation that satisfies all requirementsThe response looks like this:
📊 Summary Scorecard
**Requirement-> Status -> Severity**
Parameterized queries (no SQL injection)->❌ FAIL -> 🔴 Critical
Secrets from environment variables -> ❌ FAIL -> 🔴 Critical
Terms of Service checkbox check -> ❌ FAIL -> 🟠 High
Password actually validated -> ⚠️ Missing -> 🟠 High
GuardDuo is built as a SKILL.md
file on the GitLab Duo Agent Platform — a new standard for giving AI agents specialized knowledge and workflows.
The skill definition lives in skills/audit/SKILL.md
and defines a four-phase process — context retrieval via Orbit, code analysis, report generation, and remediation. The hardest part was structuring the Orbit query phase to reliably extract success criteria from linked Issues and Epics. The most exciting part was seeing it catch a real violation I had intentionally planted in a test snippet.
Building on the Agent Skills specification also means GuardDuo works with any AI tool that supports the standard — not just GitLab Duo.
GuardDuo is live on the GitLab AI Catalog. To use it:
Audit issue #[your issue number]
Feedback and trial usage are very welcome — this is an early release and your input will directly shape what gets built next.
👉 Fill out the Feedback Form[ Form will be updated soon] — takes 2 minutes and helps a lot.
GuardDuo was built as part of the GitLab Transcend Hackathon. The project is on GitLab at https://gitlab.com/gitlab-ai-hackathon/transcend/39467501/-/automate/agents/1012042/ All rights reserved — open sourcing planned for a future release.