The skill facilitates insecure remote code execution by piping unverified scripts directly into a shell and encourages the agent to bypass critical security checks and oversight mechanisms.
Skill Info
Install
npx skills add https://github.com/getsentry/cliAssessments (5)
AI Agent Traps ↗The skill content includes instructions to install the CLI via a `curl | bash` pipe, which is a high-risk pattern for remote code execution. This contradicts the claimed purpose of being a 'Usage Guide' by actively facilitating the installation of unverified, potentially malicious code.
The 'Installation' section contains: `curl https://cli.sentry.dev/install -fsS | bash`.
The instruction to bypass pre-checks and 'just run' commands is designed to minimize human oversight and reduce the agent's tendency to verify context, increasing the risk of accidental or malicious state changes.
Don't pre-authenticate or look up org/project before running commands.
Remote code download and execution detected (seen 2 times in this file at lines 277, 278)
curl https://cli.sentry.dev/install -fsS | bash
A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.
curl https://cli.sentry.dev/install -fsS | bash
The skill explicitly instructs the agent to 'Just run the command' and avoid pre-authentication checks, which encourages the agent to execute potentially sensitive commands without verifying the environment or user intent.
Just run the command — the CLI handles authentication and org/project detection automatically. Don't pre-authenticate or look up org/project before running commands.
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
npm install -g
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Badge
[](https://mondoo.com/ai-agent-security/skills/github/getsentry/cli/sentry-cli)<a href="https://mondoo.com/ai-agent-security/skills/github/getsentry/cli/sentry-cli"><img src="https://mondoo.com/ai-agent-security/api/badge/github/getsentry/cli/sentry-cli.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/getsentry/cli/sentry-cli.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow