sentio-platform

• Outcome: Review
• Latest audit: Aug 11, 2026 · 2:01 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent Sentio management helper, but it gives an agent broad project-changing authority, credential use, public-sharing capability, and destructive commands without enough safety guidance.

Review before installing if you use Sentio for production or sensitive projects. Use least-privilege API keys, avoid pasting long-lived secrets into chat or command arguments, verify the target project before any delete/pause/stop/import/public-sharing action, and require explicit confirmation before making queries or dashboards public.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The spec permits creating public SQL sharing links, which can expose query text and potentially embedded business logic or sensitive dataset references outside the expected project-editing workflow. In an agent context, this is risky because an agent could make internal queries externally accessible without a clear, high-friction user acknowledgment.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: Dashboard objects support public visibility and sharing, which can expose project data, metrics, or internal operational views beyond intended audiences. In a skill that manages dashboards, agent-driven modification of visibility is especially sensitive because publication can happen as a side effect of normal dashboard maintenance.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly tells the operator to ask the user for an API key and pass it on the command line, but provides no guidance on secure secret handling. API keys entered into shell commands can be exposed through terminal history, process listings, logs, screenshots, or copied transcripts, which can lead to unauthorized access to Sentio projects and data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill lists destructive operations such as alert deletion, processor pause/stop, dashboard import overwrite behavior, and project deletion without any warning, confirmation guidance, or rollback notes. In an agent-assisted workflow, this increases the chance of accidental service disruption or irreversible resource loss if commands are executed against the wrong project or environment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The SQL sharing request exposes an isPublic toggle without an explicit warning that enabling it may make query contents accessible to unintended parties. In agent workflows, missing safety language increases the chance of accidental data exposure because the model may treat publication as a routine configuration change.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Dashboard sharing supports public access but the schema does not clearly warn that dashboards may reveal sensitive operational or business data. This is dangerous in an agent-integrated skill because publication can be triggered through natural-language requests that do not fully reflect the consequences of making a dashboard public.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"ai_service.AutoConfig": {
      "properties": {
        "executeQuery": {
          "title": "Whether to automatically execute generated queries (SQL or Insight)",
          "type": "boolean"
        }
      },

• Confidence: 78% confidence
• Finding: The AI chat context allows automatically executing generated queries, which turns model output into direct side effects without a mandatory review step. That creates a meaningful risk of unintended data access, excessive-cost queries, or unsafe actions triggered by prompt manipulation or model error.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"ai_service.InsightConfig": {
      "properties": {
        "executeQuery": {
          "title": "Whether to automatically execute generated Insight queries",
          "type": "boolean"
        }
      },

• Confidence: 78% confidence
• Finding: Automatically executing AI-generated insight queries removes a human validation barrier and can let the model trigger data retrieval based on ambiguous or manipulated prompts. In a data platform context, this can expose internal analytics unintentionally or incur unnecessary compute usage.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"ai_service.SqlConfig": {
      "properties": {
        "executeQuery": {
          "title": "Whether to automatically execute generated SQL queries",
          "type": "boolean"
        }
      },

• Confidence: 82% confidence
• Finding: Automatic execution of AI-generated SQL is especially sensitive because SQL can access broad datasets and may be expensive or privacy-impacting even when read-only. In an agent setting, this materially increases the blast radius of prompt injection, misunderstanding, or unsafe query generation.

Static analysis

No suspicious patterns detected.