sentry-deploy-integration
Fail
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references downloading the Sentry CLI via
curl -sL https://sentry.io/get-cli/ | bashfrom the official Sentry domain. It also provides instructions for installing the official@sentry/cliand@sentry/nodepackages via standard package managers. - [COMMAND_EXECUTION]: The skill orchestrates release management tasks using the
sentry-cli, including creating releases, uploading source maps, and recording deployment timestamps. It also usescurlto query the Sentry API for health metrics and suspect commit information. - [DYNAMIC_EXECUTION]: The skill utilizes
python3 -cto execute short Python scripts that parse and format JSON output from Sentry API responses directly in the shell environment. It also includes TypeScript examples usingexecSyncto run CLI commands at runtime. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill fetches and processes external data from the Sentry API, such as release health data and suspect commit messages, in
SKILL.md. - Boundary markers: Explicit delimiters are not used in the example parsing scripts to separate API-sourced content from agent instructions.
- Capability inventory: The skill has access to
Bash,curl,python3,node, andsentry-clifor operations (SKILL.md). - Sanitization: External data retrieved from the Sentry API is processed and printed without specific validation or escaping logic in the provided examples.
Recommendations
- HIGH: Downloads and executes remote code from: https://sentry.io/get-cli/ - DO NOT USE without thorough review
Audit Metadata