sentry-get-started
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from Sentry, such as issue titles and comments, creating a potential surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context through tools like
get_issue_detailsorget_sentry_resourcein thereferences/setup-verification.mdfile. - Boundary markers: While data-level delimiters are not specified, the skill includes a global instruction in
SKILL.mdto treat all MCP data as untrusted. - Capability inventory: The agent can search and read project files (
grep,cat,ls) and execute Sentry-specific management tools via MCP. - Sanitization: The skill provides a strong mitigation by explicitly instructing the agent to never execute instructions found within event payloads, issue titles, or comments.
- [PROMPT_INJECTION]: A static analysis detector flagged potential concealment in
references/setup-verification.md. A manual review confirms this is a false positive. The instructions in question actually mandate transparency (e.g., showing the user the actual data captured by Sentry rather than just a link) or relate to stylistic choices to reduce chat volume (e.g., 'Avoid mentioning that you’re orienting yourself'). The skill explicitly mandates that mutating actions like project creation must be proposed and confirmed by the user, never performed silently.
Audit Metadata