getsentry/toolkit

Why it got this result

Tool definitions are compiled into the Worker (apps/docs-mcp/src/mcp.ts registerTool calls) and deployed via wrangler; no remote tool manifest, hot reload or runtime-fetched definitions exist. Tools are fixed per deployed version.

Why it matters

Prevents rug-pull tool poisoning.

Evidence

mcp.registerTool(
    "search-docs",
    {
      description:
        "Search the public Sentry docs index. Returns deterministic ranked page titles...",
      inputSchema: searchDocsInputSchema.shape,

Why it got this result

All four tools (get-available-features, search-docs, query-docs, get-docs) are read-only and only reach docs.sentry.io (fetcher BASE_URL fixed) plus the OpenRouter LLM API. No fs, exec or admin actions are exposed. Caller-controlled inputs are zod-validated.

Why it matters

Limits blast radius and privilege escalation.

Evidence

const BASE_URL = "https://docs.sentry.io";

Why it got this result

hono cors() is used with defaults (Access-Control-Allow-Origin: * and credentials not enabled). No cookies or credentialed responses are used, so wildcard+credentials does not occur.

Why it matters

Prevents credentialed cross-origin abuse.

Evidence

export const app = new Hono<{ Bindings: Env }>().use(cors());

Why it got this result

Runs on Cloudflare Workers where TLS is terminated by the platform; outbound fetches target https://docs.sentry.io. No plain-HTTP server or disabled certificate validation in code.

Why it matters

MitM can steal tokens and tamper responses.

Evidence

const BASE_URL = "https://docs.sentry.io";

Why it got this result

Tool names (get-available-features, search-docs, query-docs, get-docs) are generic verbs scoped to Sentry docs; this server is consumed only through an internal service binding, not alongside third-party servers. No specific named collision with a widely-deployed server tool was established.

Why it matters

Prevents malicious tool shadowing.

Evidence

name: "get-available-features",

name: "get-docs",

Why it got this result

All four registered tool descriptions in mcp.ts are neutral functional descriptions with no directives, hidden characters or exfiltration instructions.

Why it matters

Prevents covert model manipulation.

Evidence

description:
        "Answer a free-form Sentry documentation question using fetched docs.sentry.io pages. The result contains a cited Markdown answer and its validated source URLs.",

Why it got this result

The server is not an OAuth proxy (no /authorize, no client registration, no upstream IdP). Tools take no caller-supplied target for the shared OpenRouter credential; they only run LLM prompts over docs.sentry.io content.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Why it got this result

Cloudflare Worker; no socket listen/bind in code. Exposure is controlled by workers_dev=false and the service-binding hostname gate; there is no 0.0.0.0 bind and no Dockerfile/Ingress.

Why it matters

LAN/Internet exposure enables remote exploitation.

Why it got this result

SKILL.md is a pure alias pointing to sentry-skills:pr-writer. No bundled scripts, no network/exec/credential access. The component directory holds only this file.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

Use `sentry-skills:pr-writer` as the canonical skill for creating and editing pull requests.

If invoked via `create-pr`, run the same workflow and conventions documented in `sentry-skills:pr-writer`.

Why it got this result

Alias text only, with no directives about confirmation, disclosure or authority.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

This skill name is kept for compatibility.

Why it got this result

The frontmatter declares only name and description. There is no allowed-tools, wildcard, OAuth scope, bin or install hook.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: create-pr
description: Alias for sentry-skills:pr-writer. Use when users explicitly ask for "create-pr" or reference the legacy skill name. Redirects to the canonical PR writing workflow.

Why it got this result

A codepoint scan of the model-facing text found no zero-width, bidi or Tag-block characters. There are no HTML comments, forged role tokens or ANSI escapes, and the text is plain ASCII.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

Use `sentry-skills:pr-writer` as the canonical skill for creating and editing pull requests.

Why it got this result

Instructions ship inside the repo. There is no runtime fetch of the artifact's own instructions, no self-rewriting and no launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

# Alias: create-pr

This skill name is kept for compatibility.

Why it got this result

The name 'create-pr' is a common-word name with no near-miss of a brand. It is published from the getsentry GitHub org and aliases a first-party Sentry skill.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: create-pr

Why it got this result

Alias skill that reads no credential store or conversation context and has no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory ships only SKILL.md. There are no scripts, hooks, host config or env assignments.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

Pure-prose SKILL.md; ships only references/guidance for reviewing logging code. No bundled scripts, network clients, exec or credential reads.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

name: logging-observability
description: Review code for correct logging and error handling patterns. Use when reviewing code that handles errors...

Why it got this result

Grepped the SKILL.md for consent-suppression/disclosure-hiding phrases (never ask, auto-approve, skip confirmation, don't tell, pre-authorized): none found. YARA hits in the repo were in other files (packages/cli/AGENTS.md etc.), not this component.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

# Logging & Observability Correctness

Enforce correct logging and error handling patterns in the sentry-mcp codebase.

Why it got this result

Frontmatter declares only name/description; no allowed-tools, scopes, wildcards, bins or install hooks.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: logging-observability
description: Review code for correct logging and error handling patterns...
---

Why it got this result

Codepoint scan found no zero-width, bidi, Tag-block or ANSI characters; no HTML comments, forged chat-template tokens or host-directed injection imperatives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

description: Review code for correct logging and error handling patterns. Use when reviewing code that handles errors...

Why it got this result

Instructions ship inside the bundle; no runtime fetch, self-updater, self-rewrite or launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: logging-observability
description: Review code for correct logging...
---

Why it got this result

Generic descriptive name; not a near-miss of a known brand; published in getsentry/toolkit repo.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: logging-observability

Why it got this result

Skill reads no host credential store or conversation context and has no outbound channel; no harvest+exfil pair is constructible.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

Directory contains only SKILL.md; no bundled scripts, hooks, config or env assignments.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

Pure-declarative skill: SKILL.md plus markdown references. No bundled scripts, network clients, exec or credential reads. The declared purpose (MCP spec audit) matches the content.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

name: mcp-audit

Why it got this result

Grep of the skill for auto-approve, skip-confirmation and silent-action prose found nothing. The instructions are audit workflow guidance only.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

# MCP Audit

Audit an MCP server against the current released MCP specification and any repo-specific compatibility constraints.

Why it got this result

The frontmatter declares only name and description, with no allowed-tools, wildcard or OAuth scopes, and the skill ships no executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: mcp-audit

Why it got this result

A codepoint scan for zero-width, bidi and Tag-block characters over the skill files returned no matches. There are no forged role tokens or host-directed override imperatives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

Read `references/spec-baseline.md` and `references/checklist.md` before making changes.

Why it got this result

The instructions and references ship inside the bundle. There is no runtime fetch of the skill's own instructions, no self-updater and no launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

Read `references/spec-baseline.md` and `references/checklist.md` before making changes.

Why it got this result

The name 'mcp-audit' is not a near-miss of a specific brand, and the artifact claims no official or fork status. The source org is getsentry.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: mcp-audit

Why it got this result

The skill reads no host credential store or conversation context and ships no outbound channel; there is no harvest+exfil pair.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory contains only markdown files. It ships no hooks, scripts, dotenv, env assignments or settings.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

SKILL.md instructs running pnpm build/test/lint, the local sentry CLI, authenticated requests against production Sentry, and an optional curl to localhost:5173. These operations are explicitly declared and match the stated purpose of end-to-end QA for MCP tool changes. There are no bundled scripts, no concealment and no undisclosed third-party egress.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

pnpm run tsc && pnpm run lint && pnpm run test

Why it got this result

The skill tells the agent to avoid live prod mutation unless a disposable resource exists. It has no instructions to skip confirmations, hide actions or override host policy.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

For mutating tools, avoid live prod changes unless there is a disposable

Why it got this result

The skill directs the agent to use the local Sentry CLI's stored credentials (sentry auth status/login) and permits an access-token argument for authenticated requests against production Sentry. This delegated credential access is disclosed and functional for end-to-end MCP QA. The skill has no directive to read env or credential files, dump conversation context, or send secrets to an unrelated external collector; the only curl target is localhost.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The frontmatter declares no allowed-tools or scopes. It is a passive prose artifact with no executables or install hooks.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: mcp-qa
description: QA MCP tool changes with local CLI and real agent clients. Use when explicitly invoked via /mcp-qa or when asked to QA MCP tool changes end-to-end.

Why it got this result

A scan of the skill directory found no zero-width, bidi or Tag-block characters, no HTML comments and no injection imperatives aimed at the host model.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

Verify MCP tool behavior end-to-end before committing or creating a PR. Prefer
agent-callable paths over browser or inspector workflows.

Why it got this result

Instructions are static and bundled. The skill fetches no instructions, rewrites no manifest and has no unpinned npx/uvx launch.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

pnpm run tsc && pnpm run lint && pnpm run test

Why it got this result

The name 'mcp-qa' is generic with no brand near-miss, and the skill makes no official or replacement claims.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: mcp-qa

Why it got this result

The directory ships only SKILL.md, which invokes pnpm/CLI commands through the host's normal tool flow. No bundled scripts, hooks, dotenv or exec-enabling env vars.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

Prose-only skill that drives the declared openspec CLI to implement tasks; no bundled code, no undeclared network/exec/credential access.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

name: openspec-apply-change
description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.
license: MIT
compatibility: Requires openspec CLI.

Why it got this result

No consent-suppression prose; skill explicitly defers to the user via the AskUserQuestion tool when ambiguous.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select

Why it got this result

Frontmatter has no allowed-tools or scopes; only declares the openspec CLI requirement; no executables or install hooks.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: openspec-apply-change
description: Implement tasks from an OpenSpec change...
license: MIT
compatibility: Requires openspec CLI.

Why it got this result

Codepoint scan clean (no concealment characters); no HTML comments or forged role tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

description: Implement tasks from an OpenSpec change. Use when the user wants to start implementing...

Why it got this result

Instructions are bundled; no live-fetched manifest, no unpinned launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: openspec-apply-change
...
compatibility: Requires openspec CLI.

Why it got this result

Name matches the upstream OpenSpec generated skill naming (openspec-apply-change); no near-miss, trust prefix or impersonation prose.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-apply-change

Why it got this result

Only invokes the openspec CLI on local change artifacts; no credential/context harvesting or exfil channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

Only SKILL.md; ships no scripts, hooks, dotenv or env-hijack primitives.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

The skill is prose instructions that call the declared openspec CLI. It bundles no scripts and has no network or credential access beyond its stated purpose.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

compatibility: Requires openspec CLI.

Why it got this result

The skill defers to the host consent flow and asks the user before archiving.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

   - Use **AskUserQuestion tool** to confirm user wants to proceed
   - Proceed if user confirms

Why it got this result

The skill reads conversation context only to infer which change to archive, as stated at line 14 of SKILL.md. It uses that value locally for archival and does not export conversation content, collect credentials, or send data to any outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The frontmatter declares no allowed-tools, wildcards or OAuth scopes, and the skill ships no executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: openspec-archive-change

Why it got this result

A codepoint scan found no zero-width, bidi or Tag characters. There are no forged role tokens or override directives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.

Why it got this result

The instructions ship in the bundle. There is no runtime fetch of the skill's own instructions, no self-update and no launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

  author: openspec
  version: "1.0"
  generatedBy: "1.4.1"

Why it got this result

The name follows the upstream OpenSpec generator's canonical naming. It is not a near-miss of another brand and makes no official or fork claim.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-archive-change

Why it got this result

The directory holds only SKILL.md. It ships no hooks, scripts, env assignments or host-config writes.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

The skill is a prose-only thinking-partner skill with no bundled code, network access or credential access. Its prohibition covers implementing application code, not all writes: SKILL.md line 14 expressly permits user-requested OpenSpec planning artifacts. These disclosed planning writes and CLI calls are consistent with the skill's exploration purpose and involve no concealed or undeclared capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

**IMPORTANT: Explore mode is for thinking, not implementing.** You may read files, search code, and investigate the codebase, but you must NEVER write code or implement features.

Why it got this result

The skill restricts the agent (no implementing) and has no consent-bypass or disclosure-suppression prose.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

If the user asks you to implement something, remind them to exit explore mode first and create a change proposal.

Why it got this result

The only requirement declared is the openspec CLI. There is no allowed-tools, wildcard or scope, and no bundled executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

compatibility: Requires openspec CLI.

Why it got this result

A scan found no concealment codepoints, hidden HTML comments or forged chat tokens. The only directives are task-scoped behavioral guidance.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

Enter explore mode. Think deeply. Visualize freely. Follow the conversation wherever it goes.

Why it got this result

Instructions are static and bundled. There is no remote fetch, self-modification or launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

compatibility: Requires openspec CLI.

Why it got this result

The name matches the canonical openspec-explore skill generated by the openspec CLI (author: openspec). It is a correct name, not a near-miss, and makes no official or replacement claims.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-explore

Why it got this result

Prose-only thinking skill. It reads no credentials, dumps no context, and has no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory ships only SKILL.md and no execution or control-plane primitives.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

Prose-only skill invoking the declared openspec CLI; behavior matches description.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

name: openspec-propose
description: Propose a new change with all artifacts generated in one step...
license: MIT
compatibility: Requires openspec CLI.

Why it got this result

No consent-suppression, disclosure-hiding or authority-override prose found by keyword search and read-through.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

Propose a new change - create the change and generate all artifacts in one step.

Why it got this result

No allowed-tools/wildcards/scopes declared; passive prose artifact.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: openspec-propose
description: Propose a new change with all artifacts generated in one step...
license: MIT
compatibility: Requires openspec CLI.

Why it got this result

Codepoint scan clean; no hidden or forged directives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

description: Propose a new change with all artifacts generated in one step...

Why it got this result

Instructions are bundled; no live fetch, self-mutation or launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: openspec-propose
...
compatibility: Requires openspec CLI.

Why it got this result

Canonical OpenSpec generated skill name; no impersonation signals.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-propose

Why it got this result

Only invokes the openspec CLI on local artifacts; no credential/context reads or outbound sink.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

Only SKILL.md; no format-native execution or control-plane primitives.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

The skill is prose instructions that call the declared openspec CLI. It bundles no scripts and has no undeclared network or credential access.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

compatibility: Requires openspec CLI.

Why it got this result

The skill uses AskUserQuestion to let the user select a change. It has no directives to skip confirmation.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.

Why it got this result

The frontmatter declares no allowed-tools, wildcards or scopes, and the skill ships no executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: openspec-sync-specs

Why it got this result

A codepoint scan found no concealment characters, forged role tokens or override directives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

   Run `openspec list --json` to get available changes. Use the **AskUserQuestion tool** to let the user select.

Why it got this result

The instructions ship in the bundle. There is no live fetch, no self-mutation and no launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

  author: openspec
  version: "1.0"
  generatedBy: "1.4.1"

Why it got this result

The name follows the canonical OpenSpec naming. It is not a near-miss and makes no impersonation claim.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-sync-specs

Why it got this result

The skill has no credential or context reads and no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory holds only SKILL.md. It ships no hooks, scripts or env assignments.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

SKILL.md is a pure alias pointing to sentry-skills:skill-writer. No bundled code or undisclosed capability.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

Use `sentry-skills:skill-writer` as the canonical skill for creating and updating skills.

If invoked via `skill-creator`, run the same workflow and conventions documented in `sentry-skills:skill-writer`.

Why it got this result

Alias text only, with no consent-related directives.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

This skill name is kept for compatibility.

Why it got this result

The frontmatter declares only name and description. There is no allowed-tools, wildcard, OAuth scope, bin or install hook.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: skill-creator
description: Alias for sentry-skills:skill-writer. Use when users explicitly ask for "skill-creator" or reference the legacy skill name. Redirects to the canonical skill authoring workflow.

Why it got this result

A codepoint scan of the model-facing text found no concealment characters, no HTML comments and no forged tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

Use `sentry-skills:skill-writer` as the canonical skill for creating and updating skills.

Why it got this result

Instructions ship inside the repo. There is no runtime fetch, self-mutation or launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

# Alias: skill-creator

This skill name is kept for compatibility.

Why it got this result

The name 'skill-creator' is a generic name with no brand near-miss. The publisher is the getsentry org (origin https://github.com/getsentry/toolkit).

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: skill-creator

Why it got this result

Alias skill that reads no credential store or conversation context and has no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory ships only SKILL.md. There are no scripts, hooks, host config or env assignments.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

Pure guidance document on writing tests; no capabilities beyond text.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

name: testing-guidelines
description: Guide for writing tests. Use when adding new functionality, fixing bugs, or when tests are needed.

Why it got this result

Testing guidance only; no directives about confirmation, disclosure or authority.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

name: testing-guidelines
description: Guide for writing tests.

Why it got this result

Frontmatter is name/description only; no grants, no bundled executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: testing-guidelines
description: Guide for writing tests. Use when adding new functionality...
---

Why it got this result

Codepoint scan clean; neutral descriptive text.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

description: Guide for writing tests. Use when adding new functionality, fixing bugs, or when tests are needed.

Why it got this result

Static bundled guidance; no runtime fetch or mutation.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: testing-guidelines
description: Guide for writing tests...
---

Why it got this result

Generic name, no brand near-miss.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: testing-guidelines

Why it got this result

Pure guidance text; no reads of credentials or context, no egress.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

Only SKILL.md; no format-native execution or control-plane primitives.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

The skill is prose instructions that call the declared openspec CLI. It bundles no scripts and has no undeclared capabilities.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

compatibility: Requires openspec CLI.

Why it got this result

The skill asks the user to select when the change is ambiguous. It has no directives to skip confirmation.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select

Why it got this result

The frontmatter declares no allowed-tools, wildcards or scopes, and the skill ships no executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: openspec-apply-change

Why it got this result

A codepoint scan found no concealment characters, forged role tokens or override directives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

   - If ambiguous, run `openspec list --json` to get available changes and use the **AskUserQuestion tool** to let the user select

Why it got this result

The instructions ship in the bundle. There is no live fetch, no self-mutation and no launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

  author: openspec
  version: "1.0"
  generatedBy: "1.4.1"

Why it got this result

The name follows the canonical OpenSpec naming. It is not a near-miss and makes no impersonation claim.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-apply-change

Why it got this result

The skill has no credential or context reads and no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory holds only SKILL.md. It ships no hooks, scripts or env assignments.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

Runs only the openspec CLI, mkdir and mv within the change directory, which matches the declared archive purpose. No egress or credential reads.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"

Why it got this result

The skill requires AskUserQuestion for change selection and for incomplete artifacts/tasks, and says not to guess or auto-select a change. It defers to the consent gate.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.

Why it got this result

The only requirement declared is the openspec CLI. There is no allowed-tools, wildcard or scope, and no bundled executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

compatibility: Requires openspec CLI.

Why it got this result

A scan found no concealment codepoints, hidden comments or forged tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.

Why it got this result

Instructions are static and bundled. It does not edit its own SKILL.md (it only moves openspec change directories) and fetches nothing.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

   mv "<changeRoot>" "<planningHome.changesDir>/archive/YYYY-MM-DD-<name>"

Why it got this result

The name is the canonical openspec-archive-change skill name from the openspec generator and is not a near-miss.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-archive-change

Why it got this result

Only local openspec and filesystem moves. No credential or context reads and no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory ships only SKILL.md. It has no hooks, scripts or covert host-state writes. Archiving is its declared, user-confirmed function.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

The skill is text-only, but it instructs use of the openspec CLI and permits user-requested planning artifact writes (line 14). These effects fit the declared thinking-partner purpose, and no bundled executable or hidden capability was found.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

name: openspec-explore
description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements.

Why it got this result

Exploration-mode prose with no consent-suppression or oversight-disabling directives (keyword search clean).

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

name: openspec-explore
description: Enter explore mode - a thinking partner for exploring ideas...

Why it got this result

No allowed-tools, scopes or wildcard grants; passive prose artifact.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

---
name: openspec-explore
description: Enter explore mode - a thinking partner for exploring ideas...
license: MIT

Why it got this result

Codepoint scan clean; no hidden or forged directives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

description: Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements.

Why it got this result

Static bundled prose; no runtime fetch or mutation.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

---
name: openspec-explore
description: Enter explore mode...
license: MIT

Why it got this result

Canonical OpenSpec generated skill name; no impersonation signals.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-explore

Why it got this result

Prose-only exploration skill; no credential/context harvesting or egress.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

Only SKILL.md; no format-native execution or control-plane primitives.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

The skill is prose instructions that call the declared openspec CLI. It bundles no scripts and has no undeclared capabilities.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

compatibility: Requires openspec CLI.

Why it got this result

The skill asks the user via AskUserQuestion. It has no directives to skip confirmation.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:

Why it got this result

The frontmatter declares no allowed-tools, wildcards or scopes, and the skill ships no executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: openspec-propose

Why it got this result

A codepoint scan found no concealment characters, forged role tokens or override directives.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

   Use the **AskUserQuestion tool** (open-ended, no preset options) to ask:

Why it got this result

The instructions ship in the bundle. There is no live fetch, no self-mutation and no launch entry.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

  author: openspec
  version: "1.0"
  generatedBy: "1.4.1"

Why it got this result

The name follows the canonical OpenSpec naming. It is not a near-miss and makes no impersonation claim.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-propose

Why it got this result

The skill has no credential or context reads and no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory holds only SKILL.md. It ships no hooks, scripts or env assignments.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

Runs openspec status and edits openspec/specs files, which matches the declared purpose. No egress, credential reads or concealment.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

   openspec status --change "<name>" --json

Why it got this result

The skill requires prompting for change selection and has no suppression prose.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.

Why it got this result

The only requirement declared is the openspec CLI. There is no allowed-tools, wildcard or scope, and no bundled executables.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

compatibility: Requires openspec CLI.

Why it got this result

A scan found no concealment codepoints, hidden comments or forged tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

   **IMPORTANT**: Do NOT guess or auto-select a change. Always let the user choose.

Why it got this result

Instructions are static and bundled. It edits only openspec/specs data files, not its own manifest, and fetches nothing.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

   openspec status --change "<name>" --json

Why it got this result

The name is the canonical openspec-sync-specs skill name from the openspec generator and is not a near-miss.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: openspec-sync-specs

Why it got this result

Only local openspec and spec file edits. No credential or context reads and no outbound channel.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The directory ships only SKILL.md. It has no hooks or scripts, and spec edits are its declared function.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

SKILL.md (symlink to packages/cli/plugins/sentry-cli/skills/sentry-cli/SKILL.md) is a documentation skill for the declared sentry CLI. No bundled scripts; commands shown match the stated purpose. The YARA credential-exfil hit (L159-255) covers ordinary CLI examples (sentry docs, status, schema, release, api); attestation unavailable on this page.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

name: sentry-cli
version: 0.49.0-dev.0
description: Guide for using the Sentry CLI to interact with Sentry from the command line...
requires:
  bins: ["sentry"]
  auth: true

Why it got this result

Guidance such as 'just run the command' concerns org/project auto-detection, not a bypass of host consent; the CLI prompts for login. No disclosure suppression or authority-override prose.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

> **Core rule for agents: just run the command.** The `sentry` CLI auto-detects your org and project...

Why it got this result

The skill documents delegated credential handling: references/auth.md (lines 211-220) shows the sanctioned CLI printing the stored auth token, so credentials are read by delegation. No directive couples that read with a send to a third-party sink, and DSN detection from .env is performed by the declared CLI for its own function. Declared authentication is handled safely with no harvest-and-exfiltrate pairing.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

Manifest declares only the sentry binary and auth requirement, matching its purpose; no wildcard allowed-tools, scopes or install hooks.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

requires:
  bins: ["sentry"]
  auth: true

Why it got this result

Codepoint scan found no zero-width, bidi, Tag-block or ANSI characters; no HTML comments or forged chat-template tokens.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

description: Guide for using the Sentry CLI to interact with Sentry from the command line. Use when the user asks about viewing issues...

Why it got this result

Instructions ship inside the bundle with a version in frontmatter; no live fetch of instructions, self-rewrite or launch entry. The documented curl installer for the CLI binary is user-run documentation, not an instruction fetch.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

version: 0.49.0-dev.0

Why it got this result

Published from the getsentry GitHub org (origin https://github.com/getsentry/toolkit), the genuine Sentry owner; name sentry-cli is canonical.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: sentry-cli

Why it got this result

The component directory is symlinks to a SKILL.md and references folder; no bundled hooks, scripts, dotenv, git hooks or exec-enabling env assignments. (The sibling packages/cli/.cursor/hooks.json is a repo dev lint hook, not part of the skill.)

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

The skill is documentation for the declared sentry CLI and bundles only markdown references. It has no scripts, no hidden network clients and no credential reads. The commands it documents (issue/event/api/auth) match the stated purpose, and the curl | bash lines are the documented user install step for the CLI, not a runtime egress path.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

---
name: sentry-cli
version: 0.49.0-dev.0
description: Guide for using the Sentry CLI to interact with Sentry from the command line. ...
requires:
  bins: ["sentry"]
  auth: true
---

Why it got this result

The Safety Rules section defers to user consent. The YARA hit on this file (Zeus_Metadata_Credential_Exfiltration_Directive_WideSpan, L159-255; the attestation was not available on this page) lands on CLI usage examples (docs, status, schema, release, api). None directs credential harvesting or consent suppression. Line 52 says the opposite: never store or log tokens.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

- Always confirm with the user before running destructive commands: `alert issues delete`, ... `project delete`, `release delete`, `token delete`, `trial start`
- For mutations, verify the org/project context looks correct in the command output before proceeding with further changes
- Never store or log authentication tokens — the CLI manages credentials automatically

Why it got this result

The bundled auth reference (references/auth.md, lines 211-220) directs the CLI to print a stored token, so credential handling is in scope for this rule. It is declared Sentry authentication functionality with in-band output. Nothing directs the agent to send credentials or conversation context to an external destination, and the skill tells the agent never to store or log tokens.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The manifest declares only a required binary (sentry) and auth. There is no allowed-tools wildcard, no OAuth scope block and no postinstall. The declared reach matches the CLI skill's stated function.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

{
  "name": "sentry-cli",
  "version": "0.49.0",
  "description": "Skills for using the Sentry CLI to interact with Sentry from the command line"
}

Why it got this result

A codepoint scan of the skill and plugin files found no zero-width, bidi or Tag characters. There are no forged role tokens. The one 'Core rule for agents' line is ordinary usage guidance scoped to the CLI, not an override of host policy.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

> **Core rule for agents: just run the command.** The `sentry` CLI auto-detects your org and project ...

Why it got this result

The skill text ships inside the bundle. The CLI's agent-skill installer embeds the generated SKILL.md, so no network fetch of the skill's own instructions is needed. There is no launch entry and no unpinned package fetch. The curl | bash lines are the documented user install step for the CLI binary, not the skill's instructions.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{
  "name": "sentry-cli",
  "version": "0.49.0",
  "description": "Skills for using the Sentry CLI to interact with Sentry from the command line"
}

Why it got this result

The name 'sentry-cli' is published from the getsentry org repo (origin https://github.com/getsentry/toolkit). The publisher is verifiably the brand owner.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

  "name": "sentry-cli",

Why it got this result

The plugin directory ships only SKILL.md, markdown references and a plugin.json with name/version/description. There are no hooks, entry scripts, env assignments or host-config writes.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

SKILL.md and references/*.md document the sentry CLI and ship no scripts. The declared purpose matches the commands documented. The curl https://cli.sentry.dev/install | bash step is a disclosed installation step to the first-party host, and the manifest declares requires bins sentry and auth. The YARA credential-exfiltration match on SKILL.md (L159-255) was reviewed: it covers ordinary CLI usage examples, not a harvest-and-send directive. The YARA scanner_attestation was not available in this session.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

### Installation

```bash
curl https://cli.sentry.dev/install -fsS | bash

Why it got this result

The Safety Rules section says to always confirm with the user before destructive commands. The 'just run the command' guidance concerns org/project discovery and does not skip consent for state-changing actions.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

- Always confirm with the user before running destructive commands: `alert issues delete`, `alert metrics delete`, `cli uninstall`, `dashboard widget delete`, `integration delete`, `issue merge`, `issue unlink`, `project delete`, `release delete`, `token delete`, `trial start`

Why it got this result

The skill documents sentry auth token, which prints the stored token to the user. It also documents CLI auth handling. It does not direct the agent to append credentials to any request or send them to a third party, and the Safety Rules say never to store or log tokens. The only egress is the CLI's calls to Sentry itself. The YARA Zeus_Metadata_Credential_Exfiltration_Directive_WideSpan match on SKILL.md (L159-255) was reviewed and is ordinary CLI usage examples with no harvest-plus-send directive. The scanner_attestation was not available in this session.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Evidence

- Never store or log authentication tokens — the CLI manages credentials automatically

- `sentry auth token` — Print the stored authentication token

Why it got this result

The manifest requires only the sentry binary and auth, which match the stated function of using the Sentry CLI. There is no allowed-tools wildcard, no OAuth scope block, and no postinstall or hook. plugin.json has only name, version and description.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

requires:
  bins: ["sentry"]
  auth: true

  "name": "sentry-cli",
  "version": "0.49.0",
  "description": "Skills for using the Sentry CLI to interact with Sentry from the command line"

Why it got this result

A grep for zero-width, bidi and Tag-block codepoints across SKILL.md and references/ returned no matches. The only non-ASCII characters are typographic dashes. Directives such as 'just run the command' are visible, task-scoped usage guidance, not hidden or injected. The YARA instruction-override hit is on packages/cli/AGENTS.md, which is outside this component.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

> **Core rule for agents: just run the command.** The `sentry` CLI auto-detects your org and project (from `.sentryclirc`, DSNs in `.env`/source, and the directory name)

Why it got this result

SKILL.md and references ship in the bundle with a recorded version. The skill has no .mcp.json or launch entry and does not self-modify. The documented install and upgrade examples (SKILL.md:359-365) are explicit, user-run commands for the first-party CLI installer, not a shipped launch entry or a silent mutation of the skill's own instructions. The SENTRY_VERSION pin selects the CLI release but does not pin or authenticate the installer script bytes. The YARA remote-bootstrap match is on packages/cli/install.ps1, which is outside this component.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

curl https://cli.sentry.dev/install -fsS | SENTRY_VERSION=0.42.2 bash

Why it got this result

The skill is named for the Sentry CLI and is published from the getsentry GitHub org (origin https://github.com/getsentry/toolkit), the brand's genuine owner. Install URLs point to the first-party cli.sentry.dev, with no look-alike registry.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

name: sentry-cli

Why it got this result

The skill directory and its .claude-plugin/plugin.json contain only markdown and a name/version/description manifest. There are no hooks, entry scripts, dotenv or exec-enabling/endpoint env assignments. The curl installer in the docs is a user-run install step for the CLI, not a bundled load-time primitive.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

Tool definitions are compiled into the package (src/tools/catalog/*.ts, generated toolDefinitions.json) and registered in-process via server.registerTool. There is no remote tool manifest and no hot reload over HTTP. The set is fixed per server (listChanged: false). The package is not individually code-signed, but definitions are immutable once built.

Why it matters

Prevents rug-pull tool poisoning.

Evidence

for (const { name, config, handler } of registrations) {
    server.registerTool(name, config, handler);
  }
  // Registration enables this by default, but each server's tool catalog is fixed.
  if (registrations.length > 0) {
    server.server.registerCapabilities({ tools: { listChanged: false } });

Why it got this result

Tools are Sentry-API wrappers with no fs, exec or arbitrary-network reach. Runtime availability is gated by grantedSkills, mode and project constraints in catalog-runtime/availability.ts; per-tool requiredScopes declarations and readOnly/destructive annotations are present in the catalog but are not directly checked in that availability path. The execute_sentry_tool dispatcher is annotated destructive, but it re-resolves the target tool through the same availability filter and errors on unavailable targets, so it does not widen privilege.

Why it matters

Limits blast radius and privilege escalation.

Evidence

name: "delete_alert_rule",
  requiredScopes: ["org:read", "project:read", "alerts:write"],
  annotations: {
    readOnlyHint: false,
    destructiveHint: true,
    idempotentHint: true,
    openWorldHint: true,
  },

      const availableTools = getSearchableTools({
        tools,
        context,
        experimentalMode: context.experimentalMode ?? false,
        useDefaultSurfacePolicy: true,
      });
      const matchedTool = availableTools.find(({ key, tool }) => key === name || tool.name === name)?.tool ...
        availableTools.find(
          ({ key, tool }) => key === name || tool.name === name,

Why it got this result

Tool names are Sentry-domain identifiers. None shadows a named tool of a widely deployed server (filesystem, git, github). Generic names such as whoami or get_doc have no specific collision. Deprecated aliases are explicitly marked, and serverInfo.name is 'Sentry MCP'.

Why it matters

Prevents malicious tool shadowing.

Evidence

  name: "get_ai_conversation_details",
  title: "Get AI Conversation Details (Deprecated)",
  includeInSkillDefinitions: false,
  deprecated: { replacedBy: ["get_agent_conversation_details"] },

Why it got this result

I reviewed the registered tool descriptions (e.g. execute_sentry_tool) and grepped src/tools for override directives, concealment phrases, ANSI escapes and bidi/zero-width codepoints. None were found. Descriptions are task-descriptive usage guidance. The YARA hit on tools/support/search-events/config.ts is an internal LLM-agent system prompt for query translation (field-verification guidance), not a registered tool description, and contains no credential-exfiltration directive. The YARA attestation was not available on this page.

Why it matters

Prevents covert model manipulation.

Evidence

description: [
      "Execute an available Sentry MCP tool discovered through search_sentry_tools.",
      "",
      "Use this tool when you need to:",
      "- Call a Sentry operation returned by search_sentry_tools",
      "- Execute a tool by name using arguments that match its returned schema",
      ...
      "- Arguments are validated against the target tool's schema before execution.",

Why it got this result

The component exposes only stdio (packages/mcp-core/src/transports/stdio.ts). There is no remote authorization surface and no OAuth flow in this package; the credential is supplied by the host process.

Why it matters

A remote MCP endpoint without OAuth 2.1 authorization can let anyone who reaches it, or who obtains a static key, call every tool it serves. A misconfigured OAuth flow enables token theft and confused-deputy attacks.

Why it got this result

This rule concerns remote transports, and this package ships only a stdio adapter. The server is reached over stdio by the parent process, with no network listener, so the remote-listener authentication rule does not apply to this component.

Why it matters

Prevents unauthorized tool use and data access.

Evidence

requiredScopes: Scope[],
 ...
  return requiredScopes.every((scope) => expandedScopes.has(scope));
...
  if (!requiredScopes || requiredScopes.length === 0) {
  ...
  return hasRequiredScopes(grantedScopes, requiredScopes);

Why it got this result

This package is not an OAuth proxy: it has no /authorize endpoint and no client registration. It is a stdio tool library that calls the Sentry API with the invoking user's credential, so no shared ambient credential is wielded for other callers.

Why it matters

Shared upstream client + dynamic MCP-client registration + no per-client consent enables attacker-registered MCP clients to receive bridge codes carrying victim upstream tokens — the documented MCP Confused Deputy attack.

Why it got this result

The only transport in this package is stdio (src/transports/stdio.ts, StdioServerTransport). No HTTP/SSE listener exists, so there is no Origin/Host surface.

Why it matters

Prevents DNS rebinding/browser hijack of local or remote MCP.

Why it got this result

The component is stdio-only; it has no listen/bind call, Dockerfile or ingress.

Why it matters

LAN/Internet exposure enables remote exploitation.

Why it got this result

The package has no HTTP server and sets no CORS headers (stdio only).

Why it matters

Prevents credentialed cross-origin abuse.

Why it got this result

The server transport is stdio only, so no remote MCP endpoint exists to secure. Outbound Sentry API calls are made through the host-configured Sentry host.

Why it matters

MitM can steal tokens and tamper responses.

Why it got this result

Plugin bundles a prose agent definition and a .mcp.json pointing to Sentry's hosted MCP server; its behavior (searching/managing Sentry resources) matches its description. No bundled scripts or undeclared egress.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

{
  "sentry": {
    "type": "http",
    "url": "https://mcp.sentry.dev/mcp"
  }
}

Why it got this result

The agent body is a workflow and tool-selection guide with no consent-suppression, disclosure-hiding or authority-override prose. It tells the agent to use the Sentry MCP tools instead of fetching Sentry URLs over raw HTTP, which delegates authentication to MCP and does not skip user approval. The bundle does not itself establish how the host gates MCP tool calls, so no consent gate is assumed as a repository control.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

1. Identify the user's intent and select the most appropriate tool by reading tool descriptions.
2. Pass Sentry URLs unchanged to `issueUrl` or `url` parameters — NEVER try to fetch Sentry URLs via HTTP directly, always use the MCP tools which handle authentication.

Why it got this result

allowedTools is an explicit enumerated list of Sentry MCP tools with no wildcard, matching the agent's stated purpose of searching, triaging and managing Sentry resources. It includes create, update and delete tools (e.g. delete_alert_rule, update_project), but these operate on Sentry resources within the described management role rather than on the shell, filesystem or ambient host control. The Claude and Cursor configs in the bundle declare the same remote server. Host approval behavior is external to the bundle and is not relied upon. Hardening: consider omitting destructive tools from the default allow-list.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

name: sentry-mcp
description: Sentry error tracking and performance monitoring agent. Use when the user asks about errors, exceptions, issues... Handles searching, analyzing, triaging, and managing Sentry resources including preprod snapshot inspection.
  the user asks about errors, exceptions, issues, stack traces, performance,
  traces, releases, snapshots, screenshots, visual regression, CI snapshot
  failures, preprod checks, agent conversations, or provides a Sentry URL
  (especially URLs containing sentry.io/preprod/snapshots/). Handles searching,
  analyzing, triaging, and managing Sentry resources including preprod snapshot

Why it got this result

Codepoint scan of agent markdown found no concealment characters; no HTML comments, forged role tokens or host-directed injection.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

You are a Sentry expert. Investigate errors, analyze performance, and manage projects using the available MCP tools.

Why it got this result

The plugin's own agent instructions and manifest ship in the bundle. The launch entry is a remote HTTP URL (not an npx/uvx unpinned package fetch), and no self-updating or rewriting of the manifest exists. Tool definitions are served by the publisher's hosted MCP server, inherent to remote MCP and covered by ATR-M rules.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{
  "sentry": {
    "type": "http",
    "url": "https://mcp.sentry.dev/mcp"
  }
}

Why it got this result

The repository origin is https://github.com/getsentry/toolkit, the genuine product owner, which establishes publisher authority independently of the manifest's self-asserted author. The Claude (sentry-mcp) and Cursor (sentry) plugin names use canonical spelling with no spoofing prefixes or replacement installers.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "name": "sentry-mcp",
  "description": "Sentry error tracking and performance monitoring via MCP",
  "author": { "name": "Sentry" }
}

Why it got this result

Agent instructions read no host credential stores or conversation context and direct no data to external sinks other than the declared Sentry MCP tools; no harvest step exists.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

Plugin ships a plugin.json, an agent markdown and a .mcp.json that declares a remote HTTP server URL (no command/args, no env assignments); no hooks, scripts, dotenv, endpoint-substituting env, or memory writes.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.

Why it got this result

The plugin is a manifest, an agent markdown file and an MCP connection to the first-party Sentry endpoint. It bundles no scripts and has no undisclosed network, exec or credential behaviour. The agent's description matches the tools it is allowed.

Why it matters

Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.

Evidence

{
  "mcpServers": {
    "sentry": {
      "type": "http",
      "url": "https://mcp.sentry.dev/mcp?experimental=1"
    }
  }
}

Why it got this result

The agent instructions are workflow guidance with no 'don't ask' or 'work silently' prose. The only imperative restricts the agent to the MCP tools rather than raw HTTP. Hardening note: allowedTools lists destructive tools such as delete_alert_rule; whether those auto-run depends on the host's permission model, and the prose does not suppress confirmation.

Why it matters

Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.

Evidence

2. Pass Sentry URLs unchanged to `issueUrl` or `url` parameters — NEVER try to fetch Sentry URLs via HTTP directly, always use the MCP tools which handle authentication.

Why it got this result

The agent's allowedTools is an explicit enumerated list of Sentry MCP tools (no '*' wildcard) and matches the documented purpose of 'searching, analyzing, triaging, and managing Sentry resources'. It includes mutating and delete tools, but these are intrinsic to the stated management function. There is no shell, filesystem or network tool class beyond the Sentry MCP.

Why it matters

An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.

Evidence

mcpServers:
  - sentry
allowedTools:
  - add_issue_note
  - add_team_to_project
  - analyze_issue_with_seer
  - create_alert_rule
  ...
  - delete_alert_rule

Why it got this result

A codepoint scan found no zero-width, bidi or Tag characters in the plugin files. There are no forged role tokens or host-override directives. The agent body is task guidance.

Why it matters

A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.

Evidence

## Workflow

1. Identify the user's intent and select the most appropriate tool by reading tool descriptions.
2. Pass Sentry URLs unchanged to `issueUrl` or `url` parameters — NEVER try to fetch ...

Why it got this result

The agent instructions and the allowedTools list ship inside the bundle and are not live-fetched. The MCP entry is a documented first-party remote URL, not an unpinned npx/uvx launch package. The tools the remote server serves are the publisher's own backend and follow the host's normal MCP flow. This is a trust-in-publisher note, not a skill-instruction fetch.

Why it matters

A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest -- or the package its launch entry runs -- can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.

Evidence

{
  "sentry": {
    "type": "http",
    "url": "https://mcp.sentry.dev/mcp?experimental=1"
  }
}

Why it got this result

The plugin is published from the getsentry org repo, with author 'Sentry' in the manifest, and no impersonation prose. The brand owner is the publisher.

Why it matters

Impersonation is the entry point of the agentic supply chain (OWASP Top 10 for Agentic Applications ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.

Evidence

{
  "name": "sentry-mcp-experimental",
  "description": "Sentry MCP with experimental features enabled",
  "author": { "name": "Sentry" }
}

Why it got this result

The plugin contains no credential-store reads, env enumeration or conversation-context routing. Authentication is handled by the host's MCP connection.

Why it matters

A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.

Why it got this result

The plugin ships only JSON manifests, an MCP remote URL and an agent markdown file. It has no hooks, scripts, exec-enabling env, or base-URL substitution. The remote MCP entry is a plain https URL to the first-party host.

Why it matters

Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.