sentry-snapshots-cocoa
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Sentry CLI from
sentry.ioand theSnapshotPreviewsSwift package fromgithub.com/getsentry. Both are official vendor resources required for the skill's functionality. - [REMOTE_CODE_EXECUTION]: The skill uses
npxto run@sentry/wizard@latestand acurl | bashpipe to install the Sentry CLI. These target well-known vendor endpoints and are standard integration methods. - [COMMAND_EXECUTION]: Executes various shell commands including
xcodebuild,find, andgrep(inSKILL.mdandreferences/wizard-setup.md) for project analysis. CI templates also usesudo xcode-selectto manage environment configuration. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface due to its interaction with project-level files.
- Ingestion points: Reads
.xcodeproj,Package.swift, andproject.pbxproj(inSKILL.md). - Boundary markers: None found in the logic for processing these file types.
- Capability inventory: Shell execution (
xcodebuild), network communication (sentry-cli upload), and remote tool execution (inSKILL.md,references/wizard-setup.md). - Sanitization: Relies on the input validation of the underlying CLI tools.
Audit Metadata