The Agent Skills Directory

[DATA_EXFILTRATION]: The skill is architected to prevent unauthorized data transfer. It includes a comprehensive 'scrubber' (crash-scrubber.ts) that uses regular expressions to redact emails, bearer tokens, JWTs, and phone numbers from crash reports before they leave the device. Additionally, it enforces a privacy-first configuration (sendDefaultPii: false) and forbids the use of identity-linking functions like setUser.
[CREDENTIALS_UNSAFE]: The skill documentation and its checker script (check-crash-reporting.mjs) explicitly enforce that sensitive credentials like SENTRY_AUTH_TOKEN must never be committed to the repository or included in app configurations. It requires these to be handled as environment secrets in EAS or CI/CD pipelines.
[REMOTE_CODE_EXECUTION]: No remote code execution vulnerabilities were found. The skill relies on standard, version-pinned packages from well-known registries. It does not use curl-to-bash patterns or dynamic remote loading.
[DYNAMIC_EXECUTION]: The provided audit tool (check-crash-reporting.mjs) uses safe static analysis techniques, such as regular expression matching and bracket depth tracking, to evaluate code without executing it. It avoids dangerous functions like eval() or exec() on the audited files.
[INDIRECT_PROMPT_INJECTION]: The skill recognizes the risk of processing untrusted crash data. It addresses this through a mandatory sanitization layer (the scrubber) that filters and redacts content from captured exceptions and breadcrumbs before they are passed to the reporting SDK.
[SAFE]: The skill implements a robust consent model (opt-in/opt-out) that ensures the reporting SDK is not initialized until the user has provided permission, ensuring compliance with privacy regulations like GDPR.

crash-reporting-and-observability