sentry-code-review
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection via the processing of GitHub Pull Request comments.
- Ingestion points: The skill fetches external data from GitHub PR comments using the
gh apitool inSKILL.md(Workflow Step 1). - Boundary markers: Absent. The instructions in
SKILL.md(Workflow Step 3.4) direct the agent to read and follow the "Prompt for AI Agent" section found within the Sentry comment body without advising the agent to ignore potentially malicious instructions embedded in that data. - Capability inventory: The skill possesses high-impact capabilities, specifically the ability to modify project source code using the
Edittool (Workflow Step 4). - Sanitization: Absent. There is no logic to sanitize the content of the comments or validate the instructions extracted from the "Prompt for AI Agent" section before execution.
- Risk: If an attacker can influence the content of a PR comment (e.g., by impersonating a Sentry bot name or if the source service is compromised), they could provide malicious instructions that the agent would execute, leading to unauthorized code changes.
Audit Metadata