sentry-svelte-sdk
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches official Sentry SDK packages (@sentry/sveltekit, @sentry/svelte) and the setup wizard (@sentry/wizard) from the official npm registry. All resources originate from the verified vendor 'getsentry'.\n- [REMOTE_CODE_EXECUTION]: Invokes the @sentry/wizard via npx to automate the SDK configuration process. This is a vendor-provided tool designed to securely handle project initialization, including login and project selection.\n- [COMMAND_EXECUTION]: Performs local environment discovery using standard commands such as ls, cat, and grep. These operations are restricted to identifying the SvelteKit version and project structure to provide accurate setup guidance and do not access sensitive system files.\n- [DATA_EXFILTRATION]: Facilitates the configuration of Sentry's monitoring services, which involves transmitting diagnostic data (errors, performance traces) to the Sentry platform. The skill provides best practices for managing sensitive tokens via environment variables and using CSP headers to secure session recording data.\n- [SAFE]: Analyzed for potential indirect prompt injection vulnerabilities. 1. Ingestion points: Project metadata files (package.json, svelte.config.js). 2. Boundary markers: None. 3. Capability inventory: Package installation (npm), file modification, and tool execution (npx). 4. Sanitization: None. The surface is considered safe as it operates on local project files using trusted vendor code to perform intended developer tasks.
Audit Metadata