sentry-browser-sdk
Pass
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard shell commands such as
ls,cat, andgrepto perform environment discovery and framework detection within the local project directory. These operations are used to provide tailored setup recommendations. - [EXTERNAL_DOWNLOADS]: The skill recommends installing verified Sentry packages from the npm registry and provides script references to Sentry's official CDN domains (
sentry-cdn.com). It also suggests using standard vendor tools like@sentry/wizardand@sentry/clifor configuration tasks. - [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection because it ingests untrusted local data from project files to determine context.
- Ingestion points: Local project files including
package.json,vite.config.ts,webpack.config.js,wp-config.php, and others viacatandlscommands inSKILL.md. - Boundary markers: Absent.
- Capability inventory: Local file system reads, package installation via npm/yarn/pnpm, and build configuration modification suggestions.
- Sanitization: Absent.
Audit Metadata