sentry-snapshots-cocoa
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The GitHub Actions templates included in the skill references download and execute the
sentry-cliinstaller fromhttps://sentry.io/get-cli/using a shell pipe. This is the official installation method provided by Sentry for automation environments. - [COMMAND_EXECUTION]: The skill uses
xcodebuildto build and test targets. In the GitHub Actions templates, it usessudo xcode-selectto specify the Xcode version, which is a standard requirement for macOS runners. It also includes logic to verify the presence of Sentry environment variables without exposing their values. - [EXTERNAL_DOWNLOADS]: The skill downloads the
@sentry/wizardpackage vianpxand references theSnapshotPreviewsrepository on GitHub (https://github.com/getsentry/SnapshotPreviews). These are official vendor-maintained resources. - [PROMPT_INJECTION]: The skill implements discovery logic by reading project files like
Package.swiftandproject.pbxproj(ingestion points inSKILL.md). This creates an interface for processing external project data. The skill possesses capabilities to execute shell commands (xcodebuild) and perform network operations (sentry-cli) as documented in the skill body and reference files, which represents a surface for indirect instructions in the codebase being analyzed.
Audit Metadata