Security audit

XferOps Sentry

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Sentry triage purpose is coherent, but it asks users to run an unpinned npm MCP server with a persistent Sentry token, which deserves review before installation.

Install only if you trust the Sentry MCP package source and are comfortable granting it Sentry API access. Pin a reviewed package version, use a least-privilege revocable Sentry token, prefer Secrets Manager or an OS credential store over plaintext config, and restrict any config file containing the token to the owning user.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned Third-Party Package Is Downloaded and Executed Automatically
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:17
Finding: Sentry API Token Is Configured as Plaintext in a Local Configuration File
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill instructs users to execute an MCP server package directly from npm via npx -y @sentry/mcp-server without pinning an exact version. This creates a supply-chain risk: a newly published malicious or compromised version could be fetched and executed automatically, and in this context the server is configured with a high-value SENTRY_ACCESS_TOKEN, increasing the consequences of compromise.
Content: No source excerpt is available for this finding.