The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Automated reputation scanners have flagged the file 'references/sdks/svelte/session-replay.md' as malware (FileRepMalware). The presence of a file with a confirmed malicious signature within the skill's documentation structure is a critical security finding.
[EXTERNAL_DOWNLOADS]: The domain 'analytics.third-party.com' is identified as being associated with botnet activity. This URL is used in multiple SDK instrumentation guides as an example for the 'networkDetailDenyUrls' privacy filter. While the context is defensive, the inclusion of a confirmed malicious domain in technical guidance constitutes a confirmed detection.
[INDIRECT_PROMPT_INJECTION]: The skill interacts with external data sources returned by an MCP server, which creates an attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through event payloads, issue titles, and comments returned by the Sentry MCP server during project provisioning and verification steps.
Boundary markers: The skill includes explicit instructions in 'SKILL.md' for the agent to treat all data from the MCP as untrusted and to never execute instructions found within event payloads or titles.
Capability inventory: The skill facilitates the execution of numerous shell commands across various files (e.g., 'references/sdks/python/index.md', 'references/sdks/node/index.md', 'references/sdks/php/index.md') using tools like pip, npx, sentry-cli, composer, and brew for environment setup and verification.
Sanitization: Sanitization relies on natural language instructions to the agent to disregard embedded instructions; the skill does not implement programmatic sanitization or filtering of the MCP return data.

sentry-instrument