sentry-snapshots-cocoa

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the Sentry CLI from sentry.io and the SnapshotPreviews Swift package from github.com/getsentry. Both are official vendor resources required for the skill's functionality.
  • [REMOTE_CODE_EXECUTION]: The skill uses npx to run @sentry/wizard@latest and a curl | bash pipe to install the Sentry CLI. These target well-known vendor endpoints and are standard integration methods.
  • [COMMAND_EXECUTION]: Executes various shell commands including xcodebuild, find, and grep (in SKILL.md and references/wizard-setup.md) for project analysis. CI templates also use sudo xcode-select to manage environment configuration.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its interaction with project-level files.
  • Ingestion points: Reads .xcodeproj, Package.swift, and project.pbxproj (in SKILL.md).
  • Boundary markers: None found in the logic for processing these file types.
  • Capability inventory: Shell execution (xcodebuild), network communication (sentry-cli upload), and remote tool execution (in SKILL.md, references/wizard-setup.md).
  • Sanitization: Relies on the input validation of the underlying CLI tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 08:10 PM
Security Audit — agent-trust-hub — sentry-snapshots-cocoa