sentry-security

Sentry-specific security review based on real vulnerability history. Use when reviewing Sentry endpoints, serializers, or views for security issues. Trigger keywords: "sentry security review", "check for IDOR", "access control review", "org scoping", "cross-org", "security audit endpoint".

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

100%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tightly-written, highly actionable skill body that adds only Sentry-specific knowledge Claude lacks, sequences the review workflow with explicit validation checkpoints, and delegates detail to well-organized reference files.

Dimension	Reasoning	Score
Conciseness	Dense and assumption-respecting: no generic explanations of IDOR/XSS/CSRF, no library tutorials, and every section encodes Sentry-specific knowledge Claude lacks (patch counts, classes like OrganizationEndpoint, convert_args(), OwnerActorField).	3 / 3
Actionability	Provides concrete red-flag and safe code patterns, named classes to check, a 7-layer enforcement checklist, and a structured copy-paste report template with required fields — directly executable guidance.	3 / 3
Workflow Clarity	Clear 4-step sequence (Classify → Check top 6 → Trace enforcement chain → Report) with explicit validation checkpoints: the HIGH/MEDIUM/LOW confidence table, the "confirm absent from all layers" rule, MEDIUM fallback, and the stop-and-report-zero guard.	3 / 3
Progressive Disclosure	SKILL.md is an overview that splits detail into six clearly-signaled, one-level-deep reference files (all verified present), routed via a "Load Reference" table and an "Always load" callout, while keeping the core top-6 checks inline.	3 / 3
	Total	12 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-targeted description with explicit trigger guidance and a clear Sentry niche. The only weakness is that it names one review action across several targets rather than enumerating multiple distinct actions.

Suggestions

Consider naming a few distinct concrete actions (e.g., "traces org-scoping in ORM queries, verifies permission_classes, checks serializer field validation") to lift specificity to the multi-action anchor.

Dimension	Reasoning	Score
Specificity	Names the Sentry domain and concrete review targets ("endpoints, serializers, or views") plus a concrete basis ("real vulnerability history"), but the action is a single verb ("security review") rather than multiple distinct actions, so it stops short of the comprehensive multi-action anchor.	2 / 3
Completeness	Explicitly answers both what ("Sentry-specific security review based on real vulnerability history") and when via an explicit "Use when..." clause plus enumerated trigger keywords.	3 / 3
Trigger Term Quality	Lists natural phrases a developer would actually say — "check for IDOR", "access control review", "org scoping", "cross-org", "sentry security review", "security audit endpoint" — giving good coverage of common variations.	3 / 3
Distinctiveness Conflict Risk	The Sentry-specific scoping and Sentry-domain triggers (org scoping, cross-org, IDOR) carve a clear niche unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: getsentry/sentry
Path: .agents/skills/sentry-security/SKILL.md
Commit: b4b3565

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.