plugin

sanity Review findings

Name: sanity
Author: sanity-io

sanity-iosanity-io/agent-toolkitupdated 2 days ago

Browse GitHub Download zip Book a demo

Sanity plugin for Claude Code with MCP server, agent skills, agent rules, and slash commands.

sanity-io's own description, from the plugin's files.

Engineering AI & agentsplugin

Stars: 195
Version: v1
Copies: 0

Overview Security26 Versions1 Files101

Overview

holdReview findings

Waxell's checks found 26 findings to review, highest severity high.

Highest severity: high
Findings: 26
What ran: Static analysis

A clean result means nothing alarming in what is published, not a guarantee. How the checks work

Skills in this plugin

We don't republish the plugin's instructions. Read them on GitHub at the reviewed commit.

Security

Security scan

Checked 2 days ago

Result

Review findings Waxell's checks found 26 findings to review, highest severity high.

Checked with static analysis: servers it launches, packages it installs at runtime, scripts piped to a shell and bundled binaries. Nothing was run. How the checks work

Findings (26)

high · 25

high
Tells Claude to install unpinned packages (@portabletext/block-tools, jsdom, @sanity/schema)
skills/portable-text-conversion/rules/html-to-pt.md:18 · skill_risk:S2
high
Tells Claude to install unpinned packages (@portabletext/markdown)
skills/portable-text-conversion/rules/markdown-to-pt.md:12 · skill_risk:S2
high
Tells Claude to install unpinned packages (astro-portabletext)
skills/portable-text-serialization/rules/astro.md:12 · skill_risk:S2
high
Tells Claude to install unpinned packages (@portabletext/to-html)
skills/portable-text-serialization/rules/html.md:12 · skill_risk:S2
high
Tells Claude to install unpinned packages (@portabletext/markdown)
skills/portable-text-serialization/rules/markdown.md:12 · skill_risk:S2
high
Tells Claude to install unpinned packages (@portabletext/react)
skills/portable-text-serialization/rules/react.md:12 · skill_risk:S2
high
Tells Claude to install unpinned packages (@portabletext/svelte)
skills/portable-text-serialization/rules/svelte.md:12 · skill_risk:S2
high
Tells Claude to install unpinned packages (@portabletext/vue)
skills/portable-text-serialization/rules/vue.md:12 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/client, @sanity/image-url, @portabletext/to-html)
skills/sanity-best-practices/references/angular.md:36 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/ui@^4, styled-components)
skills/sanity-best-practices/references/app-sdk.md:35 · skill_risk:S2
high
Tells Claude to install unpinned packages (astro-portabletext, @sanity/image-url, groq)
skills/sanity-best-practices/references/astro.md:25 · skill_risk:S2
high
Tells Claude to install unpinned packages (next-sanity, @sanity/image-url)
skills/sanity-best-practices/references/get-started.md:382 · skill_risk:S2
high
Tells Claude to install unpinned packages (hydrogen-sanity, @sanity/client, @portabletext/react)
skills/sanity-best-practices/references/hydrogen.md:238 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/document-internationalization)
skills/sanity-best-practices/references/localization.md:83 · skill_risk:S2
high
Tells Claude to install unpinned packages (sanity-plugin-internationalized-array)
skills/sanity-best-practices/references/localization.md:330 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/assist)
skills/sanity-best-practices/references/localization.md:406 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/language-filter)
skills/sanity-best-practices/references/localization.md:438 · skill_risk:S2
high
Tells Claude to install unpinned packages (@portabletext/block-tools, jsdom)
skills/sanity-best-practices/references/migration-html-import.md:13 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/image-url)
skills/sanity-best-practices/references/nuxt.md:32 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/client, @sanity/react-loader, @sanity/visual-editing, @portabletext/react, groq)
skills/sanity-best-practices/references/remix.md:27 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/image-url)
skills/sanity-best-practices/references/remix.md:134 · skill_risk:S2
high
Tells Claude to install unpinned packages (schema-dts)
skills/sanity-best-practices/references/seo.md:287 · skill_risk:S2
high
Tells Claude to install unpinned packages (@sanity/sveltekit, @sanity/image-url, @portabletext/svelte)
skills/sanity-best-practices/references/svelte.md:24 · skill_risk:S2
high
Tells Claude to install unpinned packages (react, react-dom)
skills/sanity-best-practices/references/svelte.md:322 · skill_risk:S2
high
Tells Claude to install unpinned packages (@portabletext/markdown)
skills/sanity-migration/references/markdown.md:20 · skill_risk:S2

info · 1

info
Sanity: connects to mcp.sanity.io (verified in the MCP catalog)
.mcp.json · mcp_risk:M9

Versions

Version history

Each distinct content we have seen, newest first, with the verdict it got at the time.

One version so far: v1 (1.0.0), seen 2026-11-03.

Files

101 files, 657 KB in total. Names only; open them on GitHub.

.agents/plugins/marketplace.json
.claude-plugin/marketplace.json
.claude-plugin/plugin.json
.codex-plugin/plugin.json
.cursor-plugin/marketplace.json
.cursor-plugin/plugin.json
.github/workflows/ci.yml
.gitignore
.mcp.json
AGENTS.md
CONTRIBUTING.md
LICENSE
README.md
assets/logo.svg
commands/deploy-schema.md
commands/sanity-review.md
commands/sanity.md
commands/typegen.md
mcp.json
package-lock.json
package.json
plugin.json
renovate.json
scripts/validate-agent-plugin.mjs
scripts/validate-cursor-plugin.mjs
skills/content-experimentation-best-practices/SKILL.md
skills/content-experimentation-best-practices/references/cms-integration.md
skills/content-experimentation-best-practices/references/common-pitfalls.md
skills/content-experimentation-best-practices/references/experiment-design.md
skills/content-experimentation-best-practices/references/statistical-foundations.md
skills/content-modeling-best-practices/SKILL.md
skills/content-modeling-best-practices/references/content-reuse.md
skills/content-modeling-best-practices/references/reference-vs-embedding.md
skills/content-modeling-best-practices/references/separation-of-concerns.md
skills/content-modeling-best-practices/references/taxonomy-classification.md
skills/portable-text-conversion/SKILL.md
skills/portable-text-conversion/rules/html-to-pt.md
skills/portable-text-conversion/rules/manual-construction.md
skills/portable-text-conversion/rules/markdown-to-pt.md
skills/portable-text-serialization/SKILL.md
skills/portable-text-serialization/rules/astro.md
skills/portable-text-serialization/rules/html.md
skills/portable-text-serialization/rules/markdown.md
skills/portable-text-serialization/rules/plain-text.md
skills/portable-text-serialization/rules/react.md
skills/portable-text-serialization/rules/svelte.md
skills/portable-text-serialization/rules/vue.md
skills/sanity-best-practices/SKILL.md
skills/sanity-best-practices/references/angular.md
skills/sanity-best-practices/references/app-sdk.md
skills/sanity-best-practices/references/astro.md
skills/sanity-best-practices/references/blueprints.md
skills/sanity-best-practices/references/dashboard.md
skills/sanity-best-practices/references/functions.md
skills/sanity-best-practices/references/get-started.md
skills/sanity-best-practices/references/groq.md
skills/sanity-best-practices/references/hydrogen.md
skills/sanity-best-practices/references/image.md
skills/sanity-best-practices/references/localization.md
skills/sanity-best-practices/references/migration-html-import.md
skills/sanity-best-practices/references/migration.md
skills/sanity-best-practices/references/nextjs.md
skills/sanity-best-practices/references/nuxt.md
skills/sanity-best-practices/references/page-builder.md
skills/sanity-best-practices/references/portable-text.md
skills/sanity-best-practices/references/project-structure.md
skills/sanity-best-practices/references/remix.md
skills/sanity-best-practices/references/schema.md
skills/sanity-best-practices/references/seo.md
skills/sanity-best-practices/references/studio-structure.md
skills/sanity-best-practices/references/svelte.md
skills/sanity-best-practices/references/typegen.md
skills/sanity-best-practices/references/visual-editing.md
skills/sanity-form-component-suspense/SKILL.md
skills/sanity-migration/SKILL.md
skills/sanity-migration/references/aem.md
skills/sanity-migration/references/contentful.md
skills/sanity-migration/references/drupal.md
skills/sanity-migration/references/general.md
skills/sanity-migration/references/markdown.md
skills/sanity-migration/references/payload.md
skills/sanity-migration/references/strapi.md
skills/sanity-migration/references/webflow.md
skills/sanity-migration/references/wordpress.md
skills/sanity-singletons/SKILL.md
skills/sanity-studio-upgrade/SKILL.md
skills/sanity-studio-upgrade/references/boundaries.md
skills/sanity-studio-upgrade/references/boundary.v4.md
skills/sanity-studio-upgrade/references/boundary.v5.md
skills/sanity-studio-upgrade/references/boundary.v6.md
skills/sanity-studio-upgrade/references/deprecations.md
skills/sanity-studio-upgrade/references/detect.md
skills/sanity-studio-upgrade/references/package-coupling.md
skills/sanity-studio-upgrade/references/plugins.md
skills/sanity-studio-upgrade/references/report-template.md
skills/sanity-studio-upgrade/references/version-lookup.md
skills/seo-aeo-best-practices/SKILL.md
skills/seo-aeo-best-practices/references/aeo-considerations.md
skills/seo-aeo-best-practices/references/eeat-principles.md
skills/seo-aeo-best-practices/references/structured-data.md
skills/seo-aeo-best-practices/references/technical-seo.md

See and control which skills your people use

Inside your organization, Waxell scans each skill and plugin before anyone installs it, approves what passes and publishes it to a private marketplace, and puts every MCP tool call behind one governed URL.

Book a demo

30 minutes. No commitment.

SOC 2 Type II attested · ISO/IEC 27001:2022 certified · HIPAA with a BAA · aligned to the EU AI Act and NIST AI RMF

More engineering skills and plugins

See all