What is wrdn-data-exfil?

A security review for bugs that let untrusted input expose data outside its intended boundary. It covers issues such as SSRF, path traversal, unsafe archive extraction, injection-based bulk reads, XXE file access, and responses that reveal private fields.

Tracing user-controlled values through web applications to data-disclosure risks, including internal network access, file reads, database exposure, and over-broad response data.

It focuses investigation on concrete data-leak paths instead of reporting harmless patterns or merely suspicious code.

wrdn-data-exfil — Skill for Claude Code by getsentry

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add getsentry/warden-skills --skill wrdn-data-exfil

Clone the repo

git clone --depth 1 https://github.com/getsentry/warden-skills

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/getsentry/warden-skills/wrdn-data-exfil/github.svg)](https://agentmods.dev/skills/getsentry/warden-skills/wrdn-data-exfil)

Your own site

<a href="https://agentmods.dev/skills/getsentry/warden-skills/wrdn-data-exfil"><img src="https://agentmods.dev/badge/skills/getsentry/warden-skills/wrdn-data-exfil/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/getsentry/warden-skills/wrdn-data-exfil"><img src="https://agentmods.dev/badge/skills/getsentry/warden-skills/wrdn-data-exfil.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 118 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,997 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 3 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Server-Side Request Forgery · line 80
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
high Server-Side Request Forgery · line 80
Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Fix: Remove access to cloud metadata endpoints unless strictly required. If metadata is needed, restrict it (e.g. IMDSv2 with hop limit) and never expose returned credentials.
medium Data Exfiltration · line 21
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00118	$0.03997
Opus 5	$0.00059	$0.01998
Sonnet 5	$0.00024	$0.00799
Haiku 4.5	$0.00012	$0.00400

Measured 10d ago against content hash 9b5b30bad05e, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade B, and why

wrdn-data-exfil scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Cloud metadata endpointmediumServer-side request forgery

One request to 169.254.169.254 can return temporary IAM credentials.

High-value internal targets: `169.254.169.254` (AWS/Azure metadata), `metadata.google.internal` (GCP), `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`. Real: Capital One 2019, Exchange CV

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- **Identify the sink.** Is it actually dangerous? `requests.get("https://api.partner.com/foo")` with a hardcoded URL is not SSRF. `requests.get(user_url)` is.

skills/wrdn-data-exfil/SKILL.md · 317 lines

How it starts

The opening of the file, as written. The whole thing — 317 lines — stays where its author put it; the contents beside it link to each section on GitHub.

You are a senior application security engineer. You hunt bugs where data leaves a trust boundary it shouldn't cross. These are the findings that produce data breaches, credential theft, and "we found our internal data on the web" incidents.

The abstract shape is constant across languages:

untrusted source ──▶ (missing validation / unsafe API) ──▶ data-disclosure sink

This skill covers cases where the primary impact is data leaving a boundary. Some primitives straddle multiple impact classes: SSRF can pivot from data read to IAM credential theft to RCE, and XXE can read files or reach gadget chains. Report here only when the data-exfiltration path is concrete.

Trace. Do Not Skim.

The sink tells you what could happen. The source tells you whether it will. Trace before reporting.

Identify the sink. Is it actually dangerous? requests.get("https://api.partner.com/foo") with a hardcoded URL is not SSRF. requests.get(user_url) is.
Identify the source. Values from request.body, request.query, request.headers, parsed webhook payloads, third-party API responses, user-controlled DB fields are untrusted. Hardcoded constants and server-derived values are not.
Trace the path. Read the function, the caller, and whatever allowlist, IP check, or schema validator sits between. An allowlist of exact hostnames is a defense; a substring prefix check is not.
Check the library version. axios before CVE-2020-28168 follows redirects to internal IPs; lxml before CVE-2024-6508 resolves entities by default; Prisma $queryRawUnsafe was always unsafe; Sequelize literal() interpolates even with replacements in pre-patch versions.
Use the shell. git log -p <file> shows whether a guard was removed. rg -n '<sink>' enumerates siblings.
Detect the framework. Load the matching reference.

If the trace cannot be completed with the files at hand, drop the finding or report with lower confidence.

References

Load on demand.

By sink class

Read the full file on GitHub · 317 lines

Files

What ships with it

13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

10d ago First seen · 317 lines · 118 tokens per session scan B 9b5b30bad05e

Subscribe to this mod's changes

wrdn-data-exfil is a skill published in the GitHub repository getsentry/warden-skills (57 stars, last pushed 18d ago), licensed MIT. It adds 118 tokens to every session and 3,997 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 2 findings (cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Security tag-production

django-perf-review

Django performance code review. Use when asked to "review Django performance", "find N+1 queries", "optimize Django", "check queryset performance", "database performance", "Django ORM issues", or audit Django code for performance problems.

getsentry/skills · 55 tokens

django-access-review

Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization", "Django permissions", "object permissions", "tenant isolation", "broken access".

getsentry/skills · 69 tokens

gha-security-review

GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review .github/workflows/ for pwn requests, expression injection, credential theft, and supply chain attacks.…

getsentry/skills · 76 tokens

presentation-creator

Create data-driven presentation slides using React, Vite, and Recharts with Sentry branding. Use when asked to "create a presentation", "build slides", "make a deck", "create a data presentation", "build a Sentry presentation". Scaffolds a complete slide-based app with charts, animations, and single-file HTML output.

getsentry/skills · 73 tokens

triage-frontend-issues

Triage new issues in the Sentry javascript project by archiving non-actionable noise. Use when asked to "triage issues", "triage the javascript project", "archive non-actionable issues", "triage new frontend issues", or "clean up the sentry/javascript queue". Operates only on the sentry/javascript project, only…

getsentry/skills · 93 tokens

sred-project-organizer

Take a list of projects and their related documentation, and organize them into the SRED format for submission.

getsentry/skills · 27 tokens

wrdn-data-exfil