Sentry Issues

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:06 PM UTC
• Version: 1.0.0

Overview

This is a read-only Sentry helper, but its detailed output and token handling can expose sensitive Sentry data if used carelessly.

Install only where use of Sentry issue data is intended. Prefer SENTRY_AUTH_TOKEN over --token, use a narrowly scoped read-only token, avoid --details unless needed, and redact stack traces, breadcrumbs, tags, and context before sharing outputs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sentry_issues.py:27

Finding

Sentry API Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/sentry_issues.py:27-30,159; documented in SKILL.md:18-19,42
Vulnerability Type: Command-line credential exposure
Risk Level: Medium

The Skill allows users to provide a Sentry authentication token directly through the --token command-line option.

python

def get_auth_token(token_arg):
    """Get auth token from argument or environment."""
    if token_arg:
        return token_arg
    token = os.environ.get("SENTRY_AUTH_TOKEN")

python

parser.add_argument("--token", help="Auth token (or set SENTRY_AUTH_TOKEN)")

The insecure option is also explicitly documented:

markdown

Set the `SENTRY_AUTH_TOKEN` environment variable, or pass `--token` to the script.

markdown

- `--token`: Auth token (defaults to `SENTRY_AUTH_TOKEN` env var)

Technical Analysis

Command-line arguments may be exposed through process-inspection facilities, shell history, command auditing, terminal capture, orchestration metadata, diagnostic tooling, and wrapper-script logs. Consequently, invoking the script as --token TOKEN_VALUE can disclose the Sentry Bearer token to other local principals or monitoring systems that can observe process arguments or execution records.

Once obtained, the token can be replayed directly against the Sentry API. The script correctly sends the credential only to the fixed HTTPS endpoint https://sentry.io/api/0; no transmission to an unrelated host was identified. The vulnerability is therefore the command-line secret input mechanism rather than the authenticated Sentry network request itself.

Attack Path

1. A user follows the documented interface and invokes the script with --token TOKEN_VALUE.
2. The plaintext token becomes part of the process command line and may also be retained in shell history or execution logs.
3. A local user, administrator, monitoring service, or log reader with access to those ...[truncated 915 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the value-bearing --token argument so credentials cannot be supplied in the process command line.
2. Prefer SENTRY_AUTH_TOKEN supplied through a trusted secret manager or protected runtime environment.
3. If interactive credential entry is required, use a non-echoing prompt such as Python's getpass.getpass() or accept the token through standard input with clear protections against logging.
4. For automated use, support a credential file whose permissions are restricted to the owning user, validate those permissions before reading it, and avoid including its contents in errors.
5. Update SKILL.md to remove the recommendation to pass tokens through --token and document the safer credential-loading procedure.
6. Continue using narrowly scoped Sentry tokens. Retain only the documented project:read and event:read permissions unless additional permissions are strictly necessary.
7. Revoke and rotate any token previously supplied through command-line arguments if command histories, process telemetry, or execution logs may have retained it.
8. Ensure exceptions and diagnostic logs never print request headers or token values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/sentry_issues.py (reported line 49)May include surrounding context.

python

}
    req = urllib.request.Request(url, headers=headers)
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        error_body = e.read().decode("utf-8") if e.fp else ""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly instructs use of an environment variable for a Sentry API token and makes outbound API requests, but it does not declare any tool scope or permissions boundary. That omission can cause an agent runtime or reviewer to underestimate the skill's access to secrets and networked data retrieval, increasing the risk of unintended secret use or unauthorized external calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises fetching detailed Sentry issue and event data, including stack traces, tags, metadata, and browser/OS context, but provides no privacy warning about potentially sensitive contents. Sentry events often contain user identifiers, request data, tokens, paths, and internal error details, so omission of a warning increases the chance that sensitive production telemetry is retrieved, exposed, or overshared in downstream outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

When --details is used, the script emits stack traces, frame context, tags, breadcrumbs, and event context directly to stdout. Sentry events commonly contain sensitive application data such as secrets in stack-frame context, PII in breadcrumbs, internal paths, request metadata, or tokens, so unrestricted detailed output can cause accidental disclosure through terminals, logs, transcripts, or downstream agent tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.