fix-sentry-issues
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external error logs and stack traces without establishing explicit boundary markers or isolation, creating a potential surface for indirect prompt injection if an attacker can manipulate error payloads.
- Ingestion points: Sentry issue details and events retrieved via
get_issue_detailsandsearch_issue_events(SKILL.md). - Boundary markers: Absent. No specific delimiters or validation guidelines are provided to prevent the agent from executing instructions embedded in log strings.
- Capability inventory: Executes git commands (
git checkout,git pull), performs Axiom CLI queries, updates Sentry issue states viamcp__sentry__update_issue, and makes arbitrary network fetches. - Sanitization: Absent. No verification or filtering is applied to the retrieved Sentry attributes or variables.
- [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands locally for version control operations and tool queries.
- Evidence: Executes
git checkout main && git pull && git checkout -b fix/<descriptive-name>andaxiom query "['shiori-events'] | where traceId == '<traceId>'" -f json(SKILL.md). - [EXTERNAL_DOWNLOADS]: Instructs the agent to perform
fetch()requests on external URLs extracted from Sentry logs during the reproduction phase. - Evidence: Instructs the agent to "
fetch()the URLs that timed out" to verify understanding (SKILL.md), which poses a minor risk of Server-Side Request Forgery (SSRF) if the URL in the log is attacker-controlled.
Audit Metadata