GuardDuo — The AI Guardian That Keeps Vibe-Coding in Check

Anindita Priyadarshini — Wed, 24 Jun 2026 18:29:04 +0000

AI coding tools are incredible. But I noticed something — they ship code fast, skip the rules, and nobody catches it until it's already in production. That's exactly what GuardDuo is built to fix.

The Problem

We're in the age of vibe-coding. You describe what you want, the AI builds it, it works — and you ship it. But "works" and "correct" are two very different things.

Imagine asking an AI to build a login form. It works perfectly. But under the hood it has hardcoded API keys, no input validation, missing aria-labels, and it's using fetch directly instead of your project's apiClient wrapper. Your Issue said none of that was allowed. Nobody caught it.

That's the vibe-coding trap — and it's happening on every team using AI-assisted development right now.

What is GuardDuo

GuardDuo is a GitLab Duo Agent skill that acts as your AI guardian. Instead of just reviewing code in isolation, it cross-references your code changes against the actual intent of the linked GitLab Issue — using the Orbit Knowledge Graph, which is essentially the brain that knows your project's rules, requirements, and success criteria.

In plain terms: GuardDuo reads what the Issue asked for, reads what the code actually does, and tells you exactly where they don't match.

It audits across three dimensions:

🔐 Security — hardcoded secrets, SQL injection, missing input validation
♿ Accessibility — missing alt text, aria-labels, poor color contrast
📐 Standards — deviations from your project's established patterns and conventions

And when it finds a problem, it doesn't just flag it — it fixes it.

How It Works

Just open GitLab Duo Chat or GitLab Agent Platform(on your choice of IDE) -> choose the agent as GuardDuo and type:

Audit issue #[issue no.] — GuardDuo pulls the Issue context from Orbit, analyzes the code, and returns a structured report
Fix issue #[issue no.] — GuardDuo generates a corrected implementation that satisfies all requirements
Or paste any code snippet directly and ask it to audit or fix

The response looks like this:

📊 Summary Scorecard
Requirement-> Status -> Severity
Parameterized queries (no SQL injection)->❌ FAIL -> 🔴 Critical
Secrets from environment variables -> ❌ FAIL -> 🔴 Critical
Terms of Service checkbox check -> ❌ FAIL -> 🟠 High
Password actually validated -> ⚠️ Missing -> 🟠 High

How I Built It

GuardDuo is built as a SKILL.md file on the GitLab Duo Agent Platform — a new standard for giving AI agents specialized knowledge and workflows.

The skill definition lives in skills/audit/SKILL.md and defines a four-phase process — context retrieval via Orbit, code analysis, report generation, and remediation. The hardest part was structuring the Orbit query phase to reliably extract success criteria from linked Issues and Epics. The most exciting part was seeing it catch a real violation I had intentionally planted in a test snippet.

Building on the Agent Skills specification also means GuardDuo works with any AI tool that supports the standard — not just GitLab Duo.

Try It Yourself

GuardDuo is live on the GitLab AI Catalog. To use it:

Go to Explore > AI Catalog and search for GuardDuo
Enable it in your project
Open GitLab Duo Chat and type Audit issue #[your issue number]

Feedback and trial usage are very welcome — this is an early release and your input will directly shape what gets built next.

👉 Fill out the Feedback Form[ Form will be updated soon] — takes 2 minutes and helps a lot.

What's Next

CI/CD pipeline integration to run audits automatically on every MR
Automatically create remediation branches and open Merge Requests linked to Issues
Full open source release in the future, with community contributions welcome

GuardDuo was built as part of the GitLab Transcend Hackathon. The project is on GitLab at
https://gitlab.com/explore/ai-catalog/agents/1012042/
All rights reserved — open sourcing planned for a future release.