AI coding tools are incredible. But I noticed something — they ship code fast, skip the rules, and nobody catches it until it's already in production. That's exactly what GuardDuo is built to fix.
The Problem
We're in the age of vibe-coding. You describe what you want, the AI builds it, it works — and you ship it. But "works" and "correct" are two very different things.
Imagine asking an AI to build a login form. It works perfectly. But under the hood it has hardcoded API keys, no input validation, missing aria-labels, and it's using fetch directly instead of your project's apiClient wrapper. Your Issue said none of that was allowed. Nobody caught it.
That's the vibe-coding trap — and it's happening on every team using AI-assisted development right now.
What is GuardDuo
GuardDuo is a GitLab Duo Agent skill that acts as your AI guardian. Instead of just reviewing code in isolation, it cross-references your code changes against the actual intent of the linked GitLab Issue — using the Orbit Knowledge Graph, which is essentially the brain that knows your project's rules, requirements, and success criteria.
In plain terms: GuardDuo reads what the Issue asked for, reads what the code actually does, and tells you exactly where they don't match.
It audits across three dimensions:
- 🔐 Security — hardcoded secrets, SQL injection, missing input validation
- ♿ Accessibility — missing
alttext,aria-labels, poor color contrast - 📐 Standards — deviations from your project's established patterns and conventions
And when it finds a problem, it doesn't just flag it — it fixes it.
How It Works
Just open GitLab Duo Chat or GitLab Agent Platform(on your choice of IDE) -> choose the agent as GuardDuo and type:
-
Audit issue #[issue no.]— GuardDuo pulls the Issue context from Orbit, analyzes the code, and returns a structured report -
Fix issue #[issue no.]— GuardDuo generates a corrected implementation that satisfies all requirements - Or paste any code snippet directly and ask it to audit or fix
The response looks like this:
📊 Summary Scorecard
Requirement-> Status -> Severity
Parameterized queries (no SQL injection)->❌ FAIL -> 🔴 Critical
Secrets from environment variables -> ❌ FAIL -> 🔴 Critical
Terms of Service checkbox check -> ❌ FAIL -> 🟠 High
Password actually validated -> ⚠️ Missing -> 🟠 High
How I Built It
GuardDuo is built as a SKILL.md file on the GitLab Duo Agent Platform — a new standard for giving AI agents specialized knowledge and workflows.
The skill definition lives in skills/audit/SKILL.md and defines a four-phase process — context retrieval via Orbit, code analysis, report generation, and remediation. The hardest part was structuring the Orbit query phase to reliably extract success criteria from linked Issues and Epics. The most exciting part was seeing it catch a real violation I had intentionally planted in a test snippet.
Building on the Agent Skills specification also means GuardDuo works with any AI tool that supports the standard — not just GitLab Duo.
Try It Yourself
GuardDuo is live on the GitLab AI Catalog. To use it:
- Go to Explore > AI Catalog and search for GuardDuo
- Enable it in your project
- Open GitLab Duo Chat and type
Audit issue #[your issue number]
Feedback and trial usage are very welcome — this is an early release and your input will directly shape what gets built next.
👉 Fill out the Feedback Form[ Form will be updated soon] — takes 2 minutes and helps a lot.
What's Next
- CI/CD pipeline integration to run audits automatically on every MR
- Automatically create remediation branches and open Merge Requests linked to Issues
- Full open source release in the future, with community contributions welcome
GuardDuo was built as part of the GitLab Transcend Hackathon. The project is on GitLab at
https://gitlab.com/explore/ai-catalog/agents/1012042/
All rights reserved — open sourcing planned for a future release.
