fix-observability

Warn

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION] (MEDIUM): Executes multiple shell scripts from ~/.claude/skills/sentry-observability/scripts/, such as init_sentry.sh and create_alert.sh. These scripts are external to the skill bundle, meaning their specific logic and safety cannot be verified.
  • [EXTERNAL_DOWNLOADS] (LOW): Uses pnpm and npx to install and run packages from the npm registry (@sentry/nextjs, pino, posthog-js). This introduces a dependency on the supply chain security of these third-party modules.
  • [DATA_EXFILTRATION] (SAFE): Network operations using curl are performed against localhost for verification of the health endpoint, which does not pose an exfiltration risk.
  • [CREDENTIALS_UNSAFE] (SAFE): While the skill instructs the setup of sensitive environment variables like SENTRY_AUTH_TOKEN, it uses placeholders rather than hardcoding actual secrets.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 17, 2026, 06:26 PM