XferOps Sentry

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:13 AM UTC
• Version: 0.1.0

Overview

The skill’s Sentry triage purpose is coherent, but it asks users to run an unpinned npm MCP server with a persistent Sentry token, which deserves review before installation.

Install only if you trust the Sentry MCP package source and are comfortable granting it Sentry API access. Pin a reviewed package version, use a least-privilege revocable Sentry token, prefer Secrets Manager or an OS credential store over plaintext config, and restrict any config file containing the token to the owning user.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Third-Party Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 13 **Vulnerability Type**: Unpinned dependency execution through `npx` **Risk Level**: Medium ### Vulnerable Code ```bash npx -y @sentry/mcp-server --skills=inspect,triage ``` ### Technical Analysis The documented installation command uses `npx -y` to download and execute `@sentry/mcp-server` without specifying an exact reviewed version or verifying package integrity. The `-y` option suppresses the interactive installation confirmation. Consequently, the code executed when a user follows these instructions can differ from the code that existed when this Skill was audited. If the package, a transitive dependency, the associated publisher account, or the configured package registry is compromised, attacker-controlled code could run under the invoking user's account. The process may also receive `SENTRY_ACCESS_TOKEN` through its environment, increasing the sensitivity of a supply-chain compromise. This finding does not establish that the named package is currently malicious. The vulnerability is the unsafe, mutable dependency acquisition and execution pattern. ### Attack Path 1. An attacker compromises the package publisher, package registry, or a dependency used by `@sentry/mcp-server`. 2. The attacker publishes a malicious or backdoored package release that is selected by the unversioned package reference. 3. A user follows the documented setup command. 4. `npx -y` retrieves the selected release and executes it without an installation confirmation. 5. The malicious package runs with the user's local privileges. 6. When operated as configured, it may access the Sentry token supplied through the environment and use or exfiltrate that credential. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the user running `npx`. This can expose files and environment variables accessible to that user. In the documented configuration, the affected ...[truncated 256 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `@sentry/mcp-server` to an exact, reviewed version rather than allowing resolution to the latest release. - Install dependencies through a project manifest and committed lockfile instead of executing an unpinned package directly. - Verify package provenance and integrity through registry signatures, checksums, or an approved internal artifact repository. - Review both the package and its transitive dependencies before upgrades. - Avoid automatic confirmation where practical so unexpected installation behavior remains visible. - Run the MCP server in a restricted environment with only the filesystem, network, and credential access required for Sentry operations. - Supply a least-privilege, revocable Sentry token and rotate it immediately if package compromise is suspected. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17
• Finding: Sentry API Token Is Configured as Plaintext in a Local Configuration File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17–27 **Vulnerability Type**: Plaintext sensitive credential configuration **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "sentry": { "command": "npx", "args": ["-y", "@sentry/mcp-server", "--skills=inspect,triage"], "env": { "SENTRY_ACCESS_TOKEN": "your-token-here" } } } } ``` ### Technical Analysis The example directs users to replace a placeholder with a real Sentry access token inside `~/.mcporter/mcporter.json`. Although the repository itself contains no actual credential, following the documented pattern would store the token as plaintext in a persistent configuration file. Such a token may become available to other local users if file permissions are overly broad, malware running under the same account, backup and synchronization systems, diagnostic bundles, or accidental configuration-file publication. The configuration also passes the token to the external MCP server process as an environment variable. ### Attack Path 1. A user replaces `"your-token-here"` with a valid Sentry user authentication token. 2. The token remains persistently stored in `~/.mcporter/mcporter.json`. 3. An attacker obtains read access through weak file permissions, account compromise, malicious local software, an exposed backup, or accidental sharing. 4. The attacker extracts the plaintext token. 5. The attacker authenticates to the Sentry API using that token. 6. The attacker accesses organizations, projects, issues, events, or other resources allowed by the token's assigned permissions. ### Impact Assessment Exploitation does not inherently grant operating-system privilege escalation, but it can disclose a reusable Sentry credential. The attacker can act with the cloud-side privileges assigned to the affected token. Based on the documented Skill functionality, this may include enumerating organizations and projects and reading issue ...[truncated 260 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not embed the token value directly in a persistent MCP configuration file. - Retrieve the credential at runtime from an operating-system credential store, approved secrets manager, or similarly protected mechanism. - If the MCP client cannot resolve secret references, use a narrowly scoped launcher that obtains the secret immediately before execution without writing it to disk. - Assign only the minimum Sentry permissions needed for issue inspection and triage. - Prefer short-lived or regularly rotated credentials where supported. - Restrict any configuration file containing credentials to the owning user, such as mode `0600` on applicable systems. - Exclude local configuration and secret-bearing files from source control, cloud synchronization, logs, support bundles, and general-purpose backups. - Document token revocation and rotation procedures for suspected exposure. - Consider using the referenced Secrets Manager location through a controlled runtime integration rather than manually copying the token into the JSON configuration. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs users to execute an MCP server package directly from npm via `npx -y @sentry/mcp-server` without pinning an exact version. This creates a supply-chain risk: a newly published malicious or compromised version could be fetched and executed automatically, and in this context the server is configured with a high-value `SENTRY_ACCESS_TOKEN`, increasing the consequences of compromise.