sentry-deploy-integration

Fail

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references downloading the Sentry CLI via curl -sL https://sentry.io/get-cli/ | bash from the official Sentry domain. It also provides instructions for installing the official @sentry/cli and @sentry/node packages via standard package managers.
  • [COMMAND_EXECUTION]: The skill orchestrates release management tasks using the sentry-cli, including creating releases, uploading source maps, and recording deployment timestamps. It also uses curl to query the Sentry API for health metrics and suspect commit information.
  • [DYNAMIC_EXECUTION]: The skill utilizes python3 -c to execute short Python scripts that parse and format JSON output from Sentry API responses directly in the shell environment. It also includes TypeScript examples using execSync to run CLI commands at runtime.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill fetches and processes external data from the Sentry API, such as release health data and suspect commit messages, in SKILL.md.
  • Boundary markers: Explicit delimiters are not used in the example parsing scripts to separate API-sourced content from agent instructions.
  • Capability inventory: The skill has access to Bash, curl, python3, node, and sentry-cli for operations (SKILL.md).
  • Sanitization: External data retrieved from the Sentry API is processed and printed without specific validation or escaping logic in the provided examples.
Recommendations
  • HIGH: Downloads and executes remote code from: https://sentry.io/get-cli/ - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 9, 2026, 03:49 AM