docs: tighten GitLab agent auth guidance

SKILL.md

@@ -53,7 +53,7 @@ glab repo view --web              # Open repo in browser
 
 When you want different agents to appear as different GitLab users, give each agent its own GitLab bot/service account. Multiple personal access tokens on the same GitLab user still act as that same visible identity.
 
-A practical pattern is one env file per agent, for example `~/.config/openclaw/env/gitlab-reviewer.env` and `~/.config/openclaw/env/gitlab-release.env`. If those files use plain `KEY=value` lines, load them with exported vars before running `glab`:
+A practical pattern is one env file per agent, for example `~/.config/openclaw/env/gitlab-reviewer.env` and `~/.config/openclaw/env/gitlab-release.env`. Keep these env files outside version control, restrict their permissions (for example `chmod 600`), and use least-privilege bot/service-account tokens. If those files use plain `KEY=value` lines, load them with exported vars before running `glab`:
 
 ```bash
 set -a

glab-auth/SKILL.md

@@ -74,6 +74,8 @@ GITLAB_TOKEN=glpat-...
 GITLAB_HOST=gitlab.com
 ```
 
+Keep these env files outside version control, restrict their permissions (for example `chmod 600`), be mindful of backup exposure, and prefer least-privilege bot/service-account tokens.
+
 If the file uses plain `KEY=value` lines, load it with exported vars before running `glab`:
 
 ```bash
@@ -81,7 +83,7 @@ set -a
 source ~/.config/openclaw/env/gitlab-<agent>.env
 set +a
 
-glab auth status
+glab auth status --hostname "$GITLAB_HOST"
 ```
 
 Why this matters:

glab-config/SKILL.md

@@ -78,6 +78,8 @@ GITLAB_TOKEN=glpat-...
 GITLAB_HOST=gitlab.com
 ```
 
+Keep these env files outside version control, restrict their permissions (for example `chmod 600`), and use least-privilege bot/service-account tokens.
+
 Load plain `KEY=value` env files like this so the variables are exported to `glab`:
 
 ```bash