The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and utilizes official Sentry packages and command-line tools such as @sentry/node, @sentry/nextjs, and the sentry-cli. These are retrieved from the standard npm registry and official Sentry repositories. As Sentry is a well-known and reputable observability service, these downloads are considered safe and represent standard developer workflows.
[COMMAND_EXECUTION]: The skill provides instructions for executing common development commands like bun add, bun pm ls, grep, and bunx sentry-cli. These commands are used for legitimate purposes such as package management, codebase inspection for deprecated configurations, and managing Sentry releases. The use of these tools is consistent with the skill's primary purpose of configuring application monitoring.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface for indirect prompt injection as it involves the agent analyzing local codebase files (e.g., instrument.ts, sentry.config.ts) and environment variables. 1. Ingestion points: The agent reads application configuration files and package version lists. 2. Boundary markers: The skill does not explicitly define boundary markers for untrusted code analysis. 3. Capability inventory: The agent has the capability to execute shell commands and modify configuration files. 4. Sanitization: No specific sanitization of the analyzed codebase is mentioned. However, the risk is inherent to the task of code analysis and is mitigated by the skill's focus on official, non-malicious monitoring configurations.
[DATA_EXFILTRATION]: The skill correctly handles sensitive credentials by advising users to keep SENTRY_AUTH_TOKEN within CI/build environments and explicitly warns against embedding it in client-side bundles where it would be public. It also provides configuration examples for the dataCollection property to help developers restrict the collection of PII, headers, and request bodies in privacy-sensitive applications.
[DYNAMIC_EXECUTION]: The skill recommends using the Node.js --import flag to load instrumentation logic before the application starts. This is a standard and documented method for enabling Sentry's auto-instrumentation in modern Node.js environments and does not constitute malicious dynamic code generation.

sentry