Publisher: Sentry · Editorial profile by AI Tools Ratings · Review method
What task is this skill designed for?
Look for secrets that can escape when an entire object is logged, serialized, cached or attached to telemetry. Useful for Python and JavaScript/TypeScript changes involving credential holders.
What input and output should you expect?
Input: Provide object definitions, serialization methods and callers that send the whole object to logs or other sinks. Use dummy credentials, never production tokens, in examples.
Output: A source-to-sink explanation showing which field can reach which output and whether an exclusion actually covers that serialization path.
What does it need to run?
Read/search access to the relevant repository. The skill declares a read-oriented tool scope and has language-specific supporting references.
Publisher documents Claude Code installation and skills.sh support for compatible agents including Cursor, Cline and GitHub Copilot. Host permissions and invocation behavior still require validation.
How should you approach installation?
- Read the pinned SKILL.md and repository LICENSE; compare project-specific conventions with your own instructions.
- Follow the publisher installation guidance for your host, retaining the full skill folder and references; begin in a disposable repository with minimal permissions.
- Run the suggested draft or read-only trial, review its acceptance checklist, and grant write or remote permissions only for the intended task.
Installation guide: discovery, dependencies and runtime checks
What files, accounts or data can it access?
Inspects source files; no production log access is needed for the suggested trial. Credential names and architecture may enter model context, so redact actual values before sharing.
What does the skill cost?
No separate Skill purchase price is stated in the reviewed repository. The host agent subscription or model usage is separate; repository services and any authorized CI jobs may add costs. A local drafting trial does not require paid remote execution.
What are its limits and alternatives?
Excluding a field from repr does not necessarily exclude it from dictionary serialization. This focused review is not a general hardcoded-secret scanner or proof that all output channels are safe.
Use a secret scanner for accidentally committed token strings; use this workflow for structural leaks through object conversion.
What could you ask in a small trial?
Try this with a small sample:
Review a synthetic Python dataclass whose fake token has repr=False but whose asdict output is logged. Trace the conversion and sink without printing any real credentials. Explain which protection does and does not apply; make no code changes.
How would you verify the result?
- The report identifies both the credential field and the reachable output sink.
- Representation and serialization protections are evaluated separately.
- Examples contain only obvious dummy values and no live credential material.
Use a baseline and record acceptance evidence before treating a successful task as a reliable workflow.
Which source and license were checked?
Read the reviewed SKILL.md at its pinned commit · Complete reviewed folder
Repository and current publisher guidance
Checked:
Apache-2.0 — repository LICENSE at the reviewed commit. License evidence
Version details and review scope
Source: getsentry/skills/skills/secret-serialization
Reviewed commit: d12f250460ffd961f549dbebf7eeb0cf4afd4c2e
SKILL.md SHA-256: fcff1bc1e5f38bdbe9dccccd21a39846bd45e2423307fda971c9cc1e53a39d3b
Source-document review. This profile covers the source workflow, stated dependencies and license evidence. See our editorial methodology for how we distinguish source reviews and hands-on evaluations.