sentry-release-management

Pass

Audited by Gen Agent Trust Hub on Mar 24, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs shell operations using sentry-cli and git to manage the release lifecycle, including commit association and artifact uploads. This behavior is consistent with the skill's stated purpose and configuration.
  • [EXTERNAL_DOWNLOADS]: The instructions include the installation of the @sentry/cli package via npm. Sentry is a well-known service provider, and this dependency is expected for the skill's functionality.
  • [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface by interpolating data from project files into shell commands. * Ingestion points: Reads version info from package.json using node -p and commit identifiers via git rev-parse. * Boundary markers: Absent; data is directly used in shell command strings. * Capability inventory: Executes bash commands for sentry-cli, git, and node. * Sanitization: No explicit escaping or validation is performed on the data extracted from package.json or git before usage in shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 24, 2026, 05:58 PM