Sentry Cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:57 AM UTC
• Version: 1.0.1

Overview

This Sentry CLI skill is mostly purpose-aligned, but it recommends unsafe installation patterns that can execute mutable remote code on a user's machine.

Review the install section before using this skill. Prefer a trusted package manager or a pinned, verified release instead of running the pipe-to-shell command, use least-privilege Sentry tokens, and pin CI actions or dependencies when adapting the examples.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20
• Finding: Unverified Remote Script Executed Directly by Bash## Vulnerability Details **File Location**: `SKILL.md:20` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -sL https://sentry.io/get-cli/ | bash ``` ### Technical Analysis The installation command downloads a mutable script from an external URL and immediately pipes it into Bash. The downloaded content is not pinned to a specific release, saved for review, or verified using a cryptographic checksum or publisher signature. HTTPS provides transport protection but does not ensure that the response contains the same code that was reviewed when this Skill was audited. Compromise of the remote endpoint, publishing infrastructure, DNS or TLS trust chain could cause arbitrary attacker-controlled shell commands to execute. The use of `curl -sL` also suppresses normal progress output and does not include `--fail`, making failures and unexpected responses less apparent. This execution method is not necessary for the declared Sentry CLI functionality because package-manager installation alternatives are already documented in the same file. ### Attack Path 1. An attacker compromises the remote installation endpoint or its software distribution infrastructure. 2. The attacker changes the response from `https://sentry.io/get-cli/` to include malicious shell commands. 3. A user or automation agent follows the Skill's installation instructions. 4. `curl` retrieves the modified response and streams it directly into Bash. 5. Bash executes the payload without integrity verification or user inspection. 6. The payload accesses or modifies resources available to the invoking account. ### Impact Assessment The remote script receives arbitrary command-execution capability with the privileges of the user running the command. If run as a normal developer or CI user, it could read project files, Sentry tokens, source code, SSH credentials, cloud credentials, and othe ...[truncated 497 chars]
• Remediation: ## Remediation Suggestions 1. Remove the pipe-to-shell installation method and recommend a trusted package manager as the primary installation mechanism. 2. If direct installation is necessary, use a versioned release artifact rather than a mutable bootstrap endpoint. 3. Download the artifact to a local file without executing it: ```bash curl --fail --show-error --location --output sentry-cli \ "https://example.invalid/path/to/pinned/sentry-cli-version" ``` 4. Verify a publisher signature or a SHA-256 checksum obtained through an independently trusted channel before execution. 5. Inspect the downloaded file, assign only the required permissions, and install it without elevated privileges where possible. 6. Document that installation must not be run as `root` or through `sudo` unless a reviewed installation process specifically requires it. 7. Pin the installed Sentry CLI version and establish a controlled update process.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Globally Installed npm Dependency Is Not Version-Pinned## Vulnerability Details **File Location**: `SKILL.md:17` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Complete Code Snippet**: ```bash npm install -g @sentry/cli ``` ### Technical Analysis The command installs the currently resolved version of `@sentry/cli` globally rather than specifying a reviewed exact version. As a result, identical Skill instructions can install different code over time. npm installation may also run package lifecycle behavior, giving the resolved package an execution path on the local system. The package name is not evident typosquatting, and the audit found no proof that the current package is malicious. The risk arises from mutable dependency resolution and the broad effect of a global installation. A future compromised or defective release could execute or install code without any corresponding modification to this Skill. ### Attack Path 1. An attacker compromises the package publisher account, npm distribution channel, or upstream release process. 2. A malicious version is published under the expected package name. 3. A user follows the unpinned global installation command after that release becomes the resolved version. 4. npm downloads and installs the compromised package and may execute its lifecycle behavior. 5. Malicious code runs with the invoking user's privileges and establishes a globally available executable. ### Impact Assessment A compromised package could execute commands with the installing user's privileges, read accessible source code and credentials, alter user-owned files, or install a trojanized global `sentry-cli` executable. On developer systems this could expose Sentry authentication tokens, repository credentials, and project artifacts. If npm global installation is configured to require or is invoked with administrative privileges, the scope could increase to system-wide package locations and privileged files. The doc ...[truncated 103 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@sentry/cli` to a reviewed exact version instead of resolving the latest release: ```bash npm install -g @sentry/cli@EXACT_REVIEWED_VERSION ``` 2. Prefer a project-local development dependency with a committed lockfile and npm integrity metadata when global installation is unnecessary. 3. Review package provenance, release signatures, ownership changes, and lifecycle scripts before updating. 4. Use automated dependency-update tooling to propose controlled upgrades that undergo review and CI testing. 5. Avoid administrative installation and run package installation with the minimum required user privileges. 6. Where supported, enforce trusted npm registry configuration and package provenance verification.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:148
• Finding: GitHub Action Uses a Mutable Major-Version Tag## Vulnerability Details **File Location**: `SKILL.md:148` **Vulnerability Type**: Mutable CI/CD dependency reference **Risk Level**: Medium **Complete Code Snippet**: ```yaml uses: getsentry/action-release@v1 ``` ### Technical Analysis The workflow example references the GitHub Action through the mutable `v1` tag rather than a reviewed full commit SHA. The repository owner can move that tag to different code without requiring any change to the consuming workflow. GitHub Actions execute inside CI environments that commonly have repository access and injected secrets. Although the example identifies an apparently relevant Sentry project and the audit found no evidence that the current action is malicious, mutable tag resolution creates a supply-chain boundary in which future or compromised upstream code can execute automatically. ### Attack Path 1. An attacker compromises the upstream Action repository, a maintainer account, or its release process. 2. The attacker moves or replaces the `v1` tag so that it resolves to malicious code. 3. A repository using the documented workflow starts a CI job. 4. GitHub Actions resolves `getsentry/action-release@v1` to the attacker-controlled revision. 5. The malicious Action executes within the job and attempts to read available secrets, modify build artifacts, or misuse the workflow token. ### Impact Assessment The compromised Action could access files and environment variables exposed to its job, including the documented `SENTRY_AUTH_TOKEN`. Depending on workflow configuration and event type, it may also access repository metadata, artifacts, source code, and permissions granted to `GITHUB_TOKEN`. The maximum impact depends on repository workflow permissions, runner isolation, secret exposure rules, and whether the runner is hosted or self-hosted. In a permissive workflow or on a persistent self-hosted runner, compromise could affect repository contents, release artifacts, Sentr ...[truncated 40 chars]
• Remediation: ## Remediation Suggestions 1. Pin the Action to a reviewed full commit SHA: ```yaml uses: getsentry/action-release@REVIEWED_FULL_COMMIT_SHA ``` 2. Retain the corresponding release version in a comment so maintainers can identify the pinned revision. 3. Use dependency-update tooling to submit reviewed pull requests when a newer Action revision is available. 4. Restrict `GITHUB_TOKEN` through an explicit least-privilege `permissions` block. 5. Expose `SENTRY_AUTH_TOKEN` only to the step that requires it and use a least-privilege Sentry token. 6. Avoid providing secrets to workflows triggered from untrusted forks, and isolate or use ephemeral self-hosted runners. 7. Review upstream ownership, release history, and security advisories before updating the pinned SHA.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

• Category: Supply Chain

Content

npm install -g @sentry/cli

# Direct download
curl -sL https://sentry.io/get-cli/ | bash
```

## Authentication

• Confidence: 98% confidence
• Finding: The skill recommends `curl -sL https://sentry.io/get-cli/ | bash`, which downloads remote content and executes it immediately in a shell without giving the user an opportunity to inspect or verify it. If the remote endpoint, transport, or distribution pipeline is compromised, this becomes arbitrary code execution on the host running the command.

Chaining Abuse

High

• Category: Tool Misuse

Content

npm install -g @sentry/cli

# Direct download
curl -sL https://sentry.io/get-cli/ | bash
```

## Authentication

• Confidence: 97% confidence
• Finding: The `| bash` construct is inherently dangerous because it chains untrusted network output directly into command execution. In a skill intended to guide users operationally, this increases the likelihood that an agent or user will run it verbatim, turning documentation into a high-risk execution path.

Static analysis

No suspicious patterns detected.