--- title: "Secret Serialization Review: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/getsentry-secret-serialization/ description: "Finds a credential field that survives generated serialization, and the sink that stringifies the whole object." --- # Secret Serialization Review: review, setup & limitations · Undominated.ai > Finds a credential field that survives generated serialization, and the sink that stringifies the whole object. [← Explore all skills](/skills/) SECURITY / Sentry # Secret Serialization Review Finds a credential field that survives generated serialization, and the sink that stringifies the whole object. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/getsentry/skills/tree/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/secret-serialization) SOURCE REVIEW Reviewed 2026-10-15 Evidence 5 linked sources Publisher Sentry Licence [Apache-2.0 ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE) Revision d18b7aa8ba87 [Read what was—and wasn’t—checked ↓](#review) “Finds secrets, tokens, passwords, and API keys that can leak through generated serialization …” [Sentry · upstream description ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/secret-serialization/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The exclusion table says dataclasses.field(repr=False) does not block asdict, Pydantic Field(exclude=True) does not block repr, and neither flag blocks vars, __dict__ or pickle. - A finding needs a traced path. A missing test is fix guidance, not a finding. Direct token interpolation is sent to a different skill. ### A good fit for - Reviewing a new credential field on a dataclass, attrs class or Pydantic model - Reviewing a log, span or error sink that stringifies whole objects - Connect a credential holder with an existing wholesale serialization sink outside the diff - Trace a changed credential holder to existing serialization sinks outside the diff. ### Weigh up before choosing - The repository README describes the pack as skills for Sentry employees. The documented whole-pack install includes skills this catalogue has withheld. - The primary file and its exclusion table were read. Dataclass and Pydantic serialization were not executed. - The exclusion table is not a universal serializer guarantee. Custom methods and raw attribute reads can expose values independently of field flags. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - skills/secret-serialization/SKILL.md - README.md skills package section - LICENSE - vercel-labs/skills@7407f3893ad4dceab546ac002c3ef806e4000c73:README.md ### Our findings - Allowed tools are Read, Grep and Glob. The table separates generated serialization from raw attribute access. - The README install command adds the whole repository, not this directory alone. - The definition separates generated holder behavior from raw access such as vars/pickle, and requires sink-side fixes for raw attribute exposure. - Severity is high only when a sink in the repository can already receive the credential, even if that sink predates the diff. - Investigation searches the entire repository for sinks and callers, treats a missing regression test as fix guidance rather than a finding, and excludes fixtures, examples, generated code, and test-only helpers. ### Not established by this review - No serialization was executed. The JavaScript reference file was not read line by line. - Not executed: it was not installed or run. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/README.md) DOCUMENTED COMMAND npx skills add getsentry/skills/skills/secret-serialization --skill secret-serialization Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. Optional: install the reviewed revision Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose. npx skills add https://github.com/getsentry/skills/tree/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/secret-serialization --skill secret-serialization Copy reviewed-revision command ↗ - Install the complete skill directory; the Python and JavaScript/TypeScript references must travel with the SKILL.md. - Point the agent at a diff that adds credential fields or object-serializing telemetry; it reviews read-only and reports holder or sink findings. ### Before you start - Node.js/npm for the installer - An agent that supports the Agent Skills format - A Python or JavaScript/TypeScript codebase under review ### Compatibility Agent Skills-compatible coding agents · Python (dataclasses, attrs, pydantic, msgspec) and JavaScript/TypeScript codebases · Read-only review; no execution required ### Read-only source review - Read source, types and call sites - The skill says not to treat a missing test as a finding - Read source and serialization configuration; avoid copying live credential values into review output. ### Cost model Apache-2.0 instructions at no charge. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Skill definition at reviewed revision ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/secret-serialization/SKILL.md) Checked 2026-10-14 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/secret-serialization/SKILL.md Supports: summary, upstreamDescription, whySelected, limitations - [Publisher README ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md) Checked 2026-10-07 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/README.md Supports: install, compatibility - [Apache-2.0 licence ↗](https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE) Checked 2026-10-07 https://github.com/getsentry/skills/blob/d18b7aa8ba878354e5c348310230e652f7690f9c/LICENSE Supports: license - [Skills installer tree URL parsing ↗](https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/src/source-parser.ts) Checked 2026-10-07 https://github.com/vercel-labs/skills/blob/7407f3893ad4dceab546ac002c3ef806e4000c73/src/source-parser.ts Supports: install - [Pinned continuation review W04 ↗](https://raw.githubusercontent.com/getsentry/skills/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/secret-serialization/SKILL.md) Checked 2026-10-15 https://raw.githubusercontent.com/getsentry/skills/d18b7aa8ba878354e5c348310230e652f7690f9c/skills/secret-serialization/SKILL.md Supports: review.findings, bestFor KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Infisical secret scanning ↗ Infisical skill for scanning GitHub, GitLab, and Bitbucket history for leaked credentials, with GitHub tied to a github-radar connection and rotation required before history is rewritten.](/skills/infisical-secret-scanning/)[### Burp Project Parser ↗ Extract and search captured Burp traffic while distinguishing empty results from parser startup failures.](/skills/trailofbits-burpsuite-project-parser/)[### C and C++ Security Review ↗ Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger.](/skills/trailofbits-c-review/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)