Security audit

Sentry Observability

Security checks for vulnerabilities and agentic risk

Overview

The skill is for Sentry observability and is not overtly malicious, but it exposes broad Sentry admin/API actions and telemetry sharing without enough scoping or warnings.

Review this before installing in a production OpenClaw environment. Use least-privilege Sentry credentials, avoid pasting long-lived tokens into shell commands, verify or pin any plugin code you install, redact secrets and personal data before forwarding telemetry, and treat any DELETE or broad sentry api command as an explicit admin action requiring human review.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Dependencies and Mutable External Plugin Source
Content: View full analysis
`@sentry/core` is needed for `_INTERNAL_flushLogsBuffer` — Sentry's log buffer doesn't auto-flush until 100 items accumulate, which low-volume services may never hit. --- ## Plugin Code See the full implementation at https://github.com/sergical/openclaw-plugin-sentry ``` `references/plugin-setup.md:193-198`: ```markdown ## Docs - Sentry Node SDK: https://docs.sentry.io/platforms/javascript/guides/node/ - Sentry Structured Logs: https://docs.sentry.io/platforms/javascript/guides/node/logs/ - Sentry CLI Logs: https://cli.sentry.dev/commands/log/ - Plugin source: https://github.com/sergical/openclaw-plugin-sentry ``` ### Technical Analysis The installation metadata requests a global installation of the `sentry` npm package without specifying an exact version or integrity value. The implementation guide similarly installs `@sentry/node` and `@sentry/core` without exact versions or a committed lockfile. Unpinned dependency resolution allows the installed artifacts to change independently of this Skill's reviewed contents. npm packages can also execute lifecycle scripts during installation. A compromised package release, maintainer account, registry response, or dependency subtree could therefore execute code with the privileges of the user performing the installation. The actual plugin implementation is not included in the ...[truncated 1812 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:35
Finding: Authentication Token May Be Exposed Through Command-Line Arguments
Content: View full analysis
` — paste an auth token directly - `SENTRY_AUTH_TOKEN=` — env var, useful in CI ``` `references/cli-commands.md:4-7`: ```markdown ```bash sentry auth login --token # authenticate with auth token sentry auth status # check current auth ``` ``` ### Technical Analysis The documentation recommends placing an authentication token directly in a command-line argument. When a user replaces the placeholder with a real token, the secret may be retained in shell history. On systems where process command lines are visible to other users or monitoring agents, it may also be exposed through process-inspection interfaces while the command is running. Commands can additionally be captured by terminal logging, audit systems, debugging output, CI logs, support bundles, or copied shell transcripts. Although an environment-variable alternative is mentioned, inline environment-variable assignment can still enter shell history and may be exposed by improperly configured CI or diagnostic tooling. ### Attack Path 1. A user replaces `` with a valid Sentry authentication token and executes the documented command. 2. The shell records the full command in its history, or a local process monitor, terminal logger, CI system, or diagnostic collector captures it. 3. An attacker with access to that history or captured output extracts the token. 4. The attacker authenticates to Sentry using the exposed credential. 5. The attacker performs actions permitted by the token's assigned scopes. ### Impact Assessment The attacker could access or modify Sentry resources authorized by the compromised token. Depending on its scop ...[truncated 356 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented as observability and investigation, but it also documents state-changing administrative actions such as creating Sentry projects and later resolving or assigning issues. That expands the effective privilege and behavioral scope of the skill beyond passive monitoring, which can mislead users and lead to unintended modifications in a production Sentry organization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs users to send errors, structured logs, and traces from OpenClaw to Sentry without prominently warning that these payloads may contain sensitive data, prompts, user content, secrets, or operational metadata. This creates a real risk of unintentional third-party data exfiltration through telemetry.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documented commands include administrative mutations that are not tightly aligned with a narrowly scoped observability role. In practice, a user may grant broad Sentry credentials for what appears to be a read/investigate workflow, enabling accidental or unauthorized project creation and issue state changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The reference goes beyond observability and issue investigation by documenting a generic sentry api interface that supports arbitrary REST operations, including state-changing requests such as POST, PUT, and DELETE. In an agent skill context, this broadens the action surface from read-only troubleshooting into organization and project mutation, making accidental or prompt-induced destructive actions more plausible.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description emphasizes monitoring and issue investigation, but the reference includes project creation and deletion operations that materially exceed that purpose. This mismatch can mislead users or downstream agents into believing high-impact administrative actions are within normal intended use, increasing the risk of unauthorized or unintended changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation presents a destructive delete operation as a normal example with no warning, confirmation guidance, or discussion of irreversible impact. In a CLI/agent setting, such examples can be copied or executed mechanically, leading to accidental project deletion and loss of monitoring configuration or access to associated data flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly instructs implementers to forward errors, structured logs, and performance traces to Sentry, but it does not clearly warn that these streams may contain sensitive operational data, prompts, model metadata, stack traces, user identifiers, or other confidential content. In an observability plugin context, this omission can lead to unintentional third-party data disclosure through default deployment, especially because the examples encourage broad tracing and log collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The authentication section notes token-based login and storage in ~/.sentry/cli.db, but does not warn users about credential sensitivity, shell history exposure, environment leakage, or secure token handling. Users may paste long-lived tokens into commands or CI environments unsafely, increasing the chance of credential compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.