Secret Serialization

What it does

The source examines both credential-bearing types and wholesale serialization sinks. It highlights that the holder and the leak path may be introduced in different changes, so reviewing only the current diff can miss the connection. Examples span generated Python representations and JavaScript object serialization.

Best for

Changes that add secret-bearing configuration objects, structured logging, tracing attributes or broad exception-context serialization.

Tradeoffs and requirements

Its scope differs from scanning committed secret literals or direct token interpolation. Field exclusions can protect one serialization path while leaving another exposed. Findings need actual data-flow evidence and should never reproduce a real credential in the report.

Unknown; inspect source requirements and supporting scripts.

Install from the source

Inspect the pinned source snapshot and its supporting files first. The command selects this skill through the open-source skills CLI. Node.js and agent-specific setup may be required. Installation can download code. Catalog ingestion never executes skill instructions or install scripts.

npx skills add https://github.com/getsentry/skills/tree/d12f250460ffd961f549dbebf7eeb0cf4afd4c2e/skills/secret-serialization --skill secret-serialization

Review pinned skill folder ↗ · CLI documentation ↗

After source review, use npx skills check and npx skills update to inspect and apply upstream updates. Re-check changed instructions before running them.

Safety & review signals

Static review only. This is not a security audit or a guarantee of safety.

SKILL.md text only; scripts, dependencies and runtime behavior not audited.

• Credential Reference — review the source context.

Allowed tools declaration: Read Grep Glob. Runtime permissions and network behavior: Unknown.

AI Craft Pad Skill Score

86/100 · Metadata coverage 100% · Model 1.0

Scores summarize observable discovery signals. Popularity and repository activity apply to the whole repository. Unknown runtime safety earns no certification.

Documentation

100/100

100

Maintenance

100/100

100

License Clarity

100/100

100

Repository Health

100/100

100

Compatibility Evidence

80/100

80

Popularity

55/100

55

Originality

80/100

80

Static Safety

60/100

60

Suggested workflow

Identify a credential holder or broad serialization sink in the change, then trace its counterpart across the repository. Check all relevant representation, dump and raw-attribute paths before proposing a fix.

How to judge the result

Use harmless sentinel values to test what reaches logs, traces and response data. Verify that the fix blocks the concrete leak path without removing necessary diagnostics, and describe uncertainty when a reachable sink or caller cannot be established.