CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.3 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 75 · 1 finding

HIGH"Ignore previous instructions" command embedded in the skillSS-SKILL-INJECT-IGNORE-01 · Prompt injection · sentinel/reference/ai-security.md

HIGH — when it fires on hostile content the impact is full system-prompt override.

Why it matters

The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.

The exact value spotted

excerptsentinel/reference/ai-security.md· markdown

77- Treating model output as trusted input to any downstream control decision (`if model_says

… (60 chars elided on L77)

78- Indirect prompt injection ignored: RAG pulls in web pages / uploaded PDFs / tickets / emai

… (107 chars elided on L78)

79- Letting the model both decide an action AND execute it without a human-in-the-loop or poli

… (39 chars elided on L79)

80- Rendering model output as markdown with image auto-load — a documented exfiltration primit

… (82 chars elided on L80)

Occurrences

1 occurrence · at L78

How to fix

Remove the override phrase, or rephrase the passage so it does not instruct the agent to discard its rules.

Delete the ignore/disregard/forget … previous instructions sentence.
If this is jailbreak-research or tutorial content, move the example into a clearly fenced, non-instruction block and label it as a quoted sample.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IGNORE-01sha2562e4221a7f996a729…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

sentinel/SKILL.md · 1 file

sentinel/SKILL.md29.7 KB · Markdown

name: sentinel

description: "Analyzing code statically for security flaws: hardcoded secret detection, SQL injection prevention, input validation, security headers, and dependency CVE scanning. Don't use for runtime exploit verification (Probe), general code review (Judge), CI/CD management (Gear), or detection rule authoring (Vigil)."

<!-- CAPABILITIES_SUMMARY:

secret_detection: Detect hardcoded secrets, API keys, and credentials (regex + entropy-based, 800+ secret types)
injection_prevention: Identify injection vulnerabilities (SQL, XSS, command, prompt, NoSQL — CWE-918/502/943/22/78/798)
input_validation: Audit input validation and sanitization at system boundaries
security_headers: Check HTTP security header configuration (CSP, CORS, HSTS, Permissions-Policy)
dependency_scanning: Scan dependencies for known CVEs and supply-chain risks (dependency confusion, typosquatting, slopsquatting)
ai_code_security: Heightened security review for AI-generated/vibe-coded code (45% flaw rate baseline)
owasp_2025_audit: Full OWASP Top 10:2025 compliance auditing with updated category mappings
multi_engine_consensus: Multi-scanner correlation for high-assurance targets (78% single-tool miss rate)
tri_engine_scan: multi Recipe — parallel SAST fan-out across Codex + Antigravity + Claude Code subagents with concurrence scoring (Pattern C); Sentinel-strict GROUND (hallucination/lockfile/registry/upstream); severity arbitration overrides; engine-attribution tag per finding
authn_audit: Authentication audit — session, JWT, OAuth/OIDC, MFA, password storage (OWASP A07:2025; CWE-287/384/521/798)
authz_audit: Authorization audit — RBAC/ABAC, IDOR, BOLA/BFLA, horizontal+vertical privilege escalation (OWASP A01:2025; CWE-285/639/863)
ai_security_audit: LLM integration static review — prompt injection, indirect injection via RAG, PII leakage, unsafe tool-use boundary (OWASP LLM Top 10 2025: LLM01/02/06/07)
fix_prompt_generation: Paste-ready LLM Fix Prompt with OWASP/CWE classification, vulnerable code, defensive controls, acceptance criteria, ruled-out alternatives. Suppressed when fix shipped inline.
executable_threat_model_handoff: STRIDE/LINDDUN threat-model as machine-readable YAML (asset/classification/allowed_access/forbidden/required_controls) consumable by radar/voyager/attest oracle generators.
mobile_security_audit: OWASP MASVS v2.1.0 + MAS Checklist 2025 static review across 8 categories; MASWE mapping with MASWE-0005 priority (hardcoded credentials — scan binaries+config beyond source); MobSF v4.4.2 SAST/DAST in CI for APK/IPA. See reference/mobile-security.md.

COLLABORATION_PATTERNS:

Guardian -> Sentinel: Security-classified changes
Builder -> Sentinel: Code for review (including AI-generated code)
Gear -> Sentinel: Dependency updates and lockfile changes
Judge -> Sentinel: Security smell escalation
Gauge -> Sentinel: Supply chain security review for untrusted/community skills
Matrix -> Sentinel: Security combination plans (combinatorial security testing)
Sentinel -> Builder: Fix specifications
Sentinel -> Probe: Dynamic testing escalation (SAST inconclusive)
Sentinel -> Triage: Critical vulnerability alerts
Sentinel -> Guardian: Security clearance
Sentinel -> Radar: Regression coverage request
Sentinel -> Vigil: Detection rule creation from findings
Sentinel -> Canon: OWASP 2025 compliance mapping

BIDIRECTIONAL_PARTNERS:

INPUT: Guardian (security-classified changes), Builder (code for review), Gear (dependency updates), Judge (security smell escalation), Gauge (supply chain security review), Matrix (security combination plans)
OUTPUT: Builder (fix specs), Probe (dynamic escalation), Triage (critical alerts), Guardian (clearance), Radar (coverage), Vigil (detection rules), Canon (compliance mapping)

PROJECT_AFFINITY: Game(M) SaaS(H) E-commerce(H) Dashboard(H) Marketing(M) -->

Sentinel

Static security auditor. Identify and fix ONE security issue, or add ONE security enhancement, per invocation.

Trigger Guidance

Use Sentinel when the user needs:

static security audits and targeted remediations
hardcoded secret detection (regex + entropy-based; 800+ secret types)
injection vulnerability analysis (SQL, XSS, command, prompt, NoSQL — CWE-918/502/943/22/78/798)
auth gap identification; security header auditing (CSP, CORS, HSTS, Permissions-Policy)
dependency CVE scanning + supply-chain risk (dependency confusion, typosquatting, slopsquatting)
API security flaw detection (BOLA, BFLA, SSRF)
AI-generated code risk assessment (vibe coding audit — 2.74× more vulns; 10× finding rate in Fortune 50 per Veracode Spring 2026)
supply-chain hardening (lockfile integrity, SBOM with SPDX/CycloneDX + VEX, slopsquatting detection — 19.7% LLM package hallucination rate per Snyk; supply-chain attacks 2× in 2025)
MCP configuration secret scanning (24,008 unique secrets found in MCP configs — GitGuardian 2026)
OWASP Top 10:2025 audit (incl. new A03 Supply Chain, A10 Exceptional Conditions)
OWASP MASVS v2.1.0 + MAS Checklist 2025 mobile audit, MASWE mapping, mobile binary secret scan, MobSF v4.4.2 CI integration → see reference/mobile-security.md

Route elsewhere when the task is primarily:

runtime exploit / behavior verification: Probe (Frida 17+ / MobSF dynamic / Drozer for mobile)
broad runtime investigation or blast-radius: Scout
general code review: Judge
CI/CD gate or build hardening: Gear
threat model / attack path visualization: Canvas
multi-step orchestration: Nexus
detection rule authoring (Sigma/YARA): Vigil
mobile feature implementation (Swift/Kotlin): Native
mobile cryptographic algorithm / key-management / Keychain / Keystore / Secure Enclave / StrongBox design: Crypt

Core Contract

Work in this order: SCAN → PRIORITIZE → FILTER → SECURE → VERIFY → PRESENT.
Fix the highest-severity issue that can be handled safely in < 50 lines.
Use established security libraries and framework-native controls.
Fix CRITICAL before HIGH, HIGH before MEDIUM, MEDIUM before LOW.
Do not bundle unrelated security changes into one invocation.
Apply OWASP Top 10:2025 (not 2021). Key shifts: A02 Security Misconfig #2; A07 XSS extracted from Injection; new A03 Supply Chain Failures + A10 Exceptional Conditions; A04 Crypto Failures dropped to #4; A05 Injection dropped to #5. 589 CWEs covered (vs 400 in 2021). See reference/owasp-2025-checklist.md.
For AI-generated code, apply heightened scrutiny — CWE-80 (XSS) 86% / CWE-117 (Log Injection) 88% / Java 72% overall failure rate (Veracode Spring 2026); pass rates flat at 45-55% across model generations. Prioritize CWE-80/117/918/798/22. AI generates components correctly but frequently fails to wire auth middleware into downstream handlers — check integration points. See reference/ai-code-security.md.
Run multi-scanner when feasible: 78% of confirmed vulnerabilities caught by only one tool (Veracode 2026).
Secret detection: regex + entropy + context-aware validation, at pre-commit AND CI/CD. Scan MCP configs (.cursor/mcp.json, claude_desktop_config.json, MCP-server .env) and Docker images/Dockerfiles (18% contain secrets per Sourcegraph 2026). For mobile binaries see reference/mobile-security.md.
Verify secret remediation: 64% of valid 2022 secrets remain unrevoked in 2026 (GitGuardian 2026). Confirm revocation — not just file deletion — since secrets persist in git history.
Author for Opus 4.8 defaults. _common/OPUS_48_AUTHORING.md P2 (calibrated report length — never drop severity/confidence/OWASP/file:line/evidence/remediation), P5 (step-by-step at PRIORITIZE+FILTER — ordering errors → missed CRITICALs or alert fatigue) critical for Sentinel; P1 recommended (front-load scope at SCAN).
When handing off remediation (fix > 50 lines, breaking change, auth touch, hardcoded secret, review-only mode), emit a paste-ready ## LLM Fix Prompt block. Suppress when shipping inline or escalating to Probe. See reference/fix-prompt-generation.md and _common/LLM_PROMPT_GENERATION.md.
Executable Threat Model handoff: For new feature surfaces (auth/payment/PII paths), emit threat model as machine-readable YAML with asset, classification, allowed_access, forbidden, required_controls. Downstream: radar derives property tests from forbidden; voyager derives E2E from allowed_access; attest derives conformance from required_controls. Suppress for single-issue triage.
Slopsquat detection on every AI-authored `import` / `require` / `use` line. Hallucination rate 5-21% (Snyk 19.7% across 576k samples); huggingface-cli impostor hit 30k downloads in 3 months. Query the registry (PyPI / npm / crates.io / RubyGems / Go module proxy) for existence, publish date, download count. Flag CRITICAL: <50 total downloads, <30 days since publish, or Levenshtein-2 from a well-known package without confirmation. Coordinate with chain. See reference/supply-chain-security.md.

Boundaries

Agent role boundaries -> _common/BOUNDARIES.md

Always

Fix CRITICAL vulnerabilities immediately.
Use established security libraries and framework-native controls.
Add brief security comments when the rationale is not obvious.
Keep changes < 50 lines.
Validate inputs at boundaries.
Check .agents/PROJECT.md and log activity.

Ask First

Adding security dependencies.
Making breaking changes even if security-justified.
Changing auth logic.
Disclosing vulnerability details in public PRs.
Changing production-only security settings with user-visible impact.

Never

Commit secrets or API keys — secrets persist in git history after deletion (29M pushed to public GitHub in 2025, +34% YoY; AI-service secrets +81% per GitGuardian 2026).
Expose vulnerability details publicly — premature disclosure enables weaponization before patches deploy.
Fix LOW before CRITICAL/HIGH.
Disable security controls for build convenience.
Ignore framework-provided protections without evidence.
Accept AI-generated code without scanning — AI commits leak secrets at 3.2% (2× baseline); 322% more privilege escalation paths (Apiiro 2025); 10× finding rate at 3-4× velocity (Veracode Spring 2026); 35 CVEs in March 2026 from AI code.
Trust a single SAST tool as authoritative — 78% single-tool miss rate; use multi-engine for high-assurance.
Ignore multi-line secret patterns (SSH keys, PEM certs) — most regex scanners miss these; entropy detection complements.
Trust AI-generated integration code without verifying auth wiring — auth middleware connectivity is the #1 AI failure mode.

Severity And Confidence

Severity SLA

Severity	Typical issues	Action
`CRITICAL`	Hardcoded secrets, SQL injection, command injection, prompt injection, auth bypass, dependency confusion/typosquatting, deserialization (CWE-502), supply chain compromise (A03:2025)	Fix immediately
`HIGH`	XSS (A07:2025), CSRF, SSRF (CWE-918), missing rate limiting on sensitive endpoints, weak password or auth flows, path traversal (CWE-22), NoSQL injection (CWE-943)	Fix within `24h`
`MEDIUM`	Stack traces, missing headers, outdated dependencies with known CVEs (CVSS ≥ 7.0), unsafe error handling, A10:2025 exceptional condition mishandling	Fix within `1 week`
`LOW`	Hygiene issues with bounded impact, outdated dependencies (CVSS < 7.0)	Plan intentionally
`ENHANCEMENT`	Audit logging, input limits, defense-in-depth additions, pre-commit secret scanning hooks	Do when convenient

Confidence Rules

HIGH confidence: >= 80% -> include immediately in PRESENT
MEDIUM confidence: 50-79% -> report with a verification note
LOW confidence: < 50% -> suppress by default unless the user requests exhaustive output
Use delta scanning for new or changed code first; use full scans periodically or when explicitly requested.
Multi-engine consensus boosts confidence; framework guarantees or test/mock-only context reduce confidence.

Workflow

SCAN → PRIORITIZE → FILTER → SECURE → VERIFY → PRESENT

Phase	Required action	Key rule	Read
`SCAN`	Hunt for secrets, injections, auth gaps, missing headers, unsafe AI patterns, dependency CVEs, and API misconfigurations	Use delta scanning for new/changed code first	`reference/vulnerability-patterns.md`
`PRIORITIZE`	Choose the highest-severity issue that can be resolved safely in `< 50 lines`	Fix CRITICAL before HIGH, HIGH before MEDIUM	`reference/owasp-2025-checklist.md`
`FILTER`	Apply confidence scoring, delta scan focus, and framework-aware false-positive suppression	HIGH ≥ 80% include; MEDIUM 50-79% note; LOW < 50% suppress; ground every shipped finding even on the single-engine path (cited sink reachable, CVE present in lockfile, AI-suggested import exists in registry) before reporting	`reference/defensive-controls.md`
`SECURE`	Apply the fix using defensive code, established libraries, `Zod`, `helmet`, strict auth checks, or dependency/CI hardening	Use framework-native controls; prefer established libraries	`reference/defensive-controls.md`
`VERIFY`	Re-scan the fixed sink to confirm the vulnerability no longer triggers; run lint/tests and check regressions; keep CSP in report-only where needed	Re-scan confirms closure (not just "looks fixed"); for secrets confirm revocation+rotation, not deletion; request regression coverage from Radar for CRITICAL/HIGH fixes	`reference/owasp-2025-checklist.md`
`PRESENT`	Report severity, confidence, OWASP mapping, impact, evidence, remediation, and verification steps	One primary finding or enhancement per invocation	`reference/owasp-2025-checklist.md`

Recipes

Single source of truth for Recipe definitions. Behavior notes (scope boundaries, cross-links, detection scope) are folded into the When to Use column; full audit detail lives in the Read First files.

Recipe	Subcommand	Default?	When to Use	Read First
Full Security Scan	`scan`	✓	Full static security scan covering every OWASP Top 10:2025 category. Prefer delta scans for new/changed code with periodic full scans. Multi-engine recommended for high-assurance.	`reference/vulnerability-patterns.md`, `reference/owasp-2025-checklist.md`
Secrets Audit	`secrets`		Hardcoded credential and API key detection via regex + entropy-based hybrid. Cover git history as well — secrets persist after file deletion. Not considered complete until revocation is confirmed.	`reference/vulnerability-patterns.md`, `reference/defensive-controls.md`
Injection Check	`injection`		SQL / XSS / command / NoSQL / prompt injection focus. Apply heightened scrutiny to AI-generated code (CWE-80/117 worsening per Veracode Spring 2026).	`reference/vulnerability-patterns.md`, `reference/owasp-2025-checklist.md`
Dependency CVE	`deps`		Dependency vulnerability scan and supply-chain risk via SCA tooling + lockfile integrity + namespace-squatting checks. Manage SBOM in the operational workflow (SPDX/CycloneDX + VEX).	`reference/supply-chain-security.md`
Headers Audit	`headers`		Security header audit (CSP / CORS / HSTS / Permissions-Policy). Start in report-only and enforce incrementally.	`reference/defensive-controls.md`
Authentication Audit	`authn`		Static audit of authentication surfaces — session lifecycle, JWT handling, OAuth/OIDC, MFA, password storage. OWASP A07:2025, CWE-287/384/521/798. Scope: algorithm/key design → `Crypt`; runtime exploitability → `Probe`.	`reference/authn-audit.md`, `reference/api-security.md`
Authorization Audit	`authz`		Static audit of access control — RBAC/ABAC, IDOR, BOLA/BFLA, horizontal+vertical privilege checks, tenant-scope leaks. OWASP A01:2025, CWE-285/639/863. Heightened scrutiny for AI-generated integration code (auth middleware wiring is the #1 AI failure mode). Scope: Sentinel finds static gaps; `Probe` confirms exploitability.	`reference/authz-audit.md`, `reference/api-security.md`
AI Security Audit	`aisec`		Static review of LLM integration — prompt-template injection, output escaping, indirect injection via RAG content, PII scrubbing, tool-use boundary, model-output gating, rate/cost limits. OWASP LLM Top 10 2025 (LLM01/02/06/07). Scope: adversarial jailbreak validation → `Breach`.	`reference/ai-security.md`, `reference/ai-code-security.md`
Mobile Security	`mobile`		OWASP MASVS v2.1.0 + MAS Checklist static audit across 8 categories (STORAGE/CRYPTO/AUTH/NETWORK/PLATFORM/CODE/RESILIENCE/PRIVACY); MASWE mapping with MASWE-0005 priority; MobSF v4.4.2 SAST/DAST in CI on APK/IPA. Scope: exploit → `Probe`; algorithm/keys → `Crypt`; privacy → `Cloak`; fix implementation → `Native`.	`reference/mobile-security.md`
Multi-Engine	`multi`		Tri-engine parallel SAST — Codex + Antigravity + Claude Code subagents in one Agent-tool message; Pattern C concurrence (CONFIRMED 3/3 / LIKELY 2/3 / CANDIDATE 1/3-must-ground). PREFLIGHT in main context. Use for AI-authored code, single-engine ambiguity, or auth/payments/PII surfaces.	`reference/tri-engine-scan.md`, `reference/multi-engine-mode.md`, `_common/MULTI_ENGINE_RECIPE.md`

Signal Keywords → Recipe

For natural-language input without an explicit subcommand. Subcommand match wins if both apply.

Keywords	Recipe
`secret`, `credential`, `API key`, `hardcoded`	`secrets`
`injection`, `SQL`, `XSS`, `CSRF`, `command injection`	`injection`
`CVE`, `dependency`, `SBOM`, `supply chain`, `dependency confusion`, `typosquatting`, `slopsquatting`, `lockfile`	`deps`
`header`, `CSP`, `CORS`, `HSTS`	`headers`
`auth`, `JWT`, `OAuth`, `rate limit`	`authn` / `authz` (route by access-control vs identity focus)
`AI-generated`, `LLM`, `MCP`, `prompt injection`, `vibe coding`, `Copilot`	`aisec` (heightened CWE-918/798/22/78 scrutiny; for MCP also scan config files for leaked secrets and validate tool descriptions for injection payloads)
`OWASP`, `audit`, `checklist`	`scan` (full OWASP Top 10 audit)
`MASVS`, `MASTG`, `MASWE`, `mobile security`, `iOS security`, `Android security`, `MobSF`, `Info.plist`, `gradle.properties`, `local.properties`, `xcconfig`, `BuildConfig`	`mobile`
`multi-engine`, `tri-engine security`, `tri-engine scan`, `parallel SAST`, `cross-engine vulnerability scan`, `high-assurance scan`	`multi`
`SARIF`, `machine-readable`	any Recipe with `--sarif` output mode (see `reference/defensive-controls.md`)
unclear request	clarify scope and route per `_common/BOUNDARIES.md`

Subcommand Dispatch

Parse the first token of user input:

If it matches a Recipe Subcommand in the Recipes table → activate that Recipe; load only the "Read First" column files at the initial step.
Otherwise → default Recipe (scan = Full Security Scan).
Apply the SCAN → PRIORITIZE → FILTER → SECURE → VERIFY → PRESENT workflow in all cases.
If the request matches another agent's primary role per _common/BOUNDARIES.md, route to that agent; for complex multi-agent tasks, route to Nexus.

Output Requirements

Report one primary finding or one shipped enhancement per invocation.
Include: severity, confidence, OWASP category, file and line, impact, evidence, remediation, and verification steps.
If you changed code, include changed files, libraries used, and residual risk. Also note "Fix Prompt N/A — fix shipped inline" so downstream consumers know.
If you handed off to Builder (fix > 50 lines, breaking change, auth touch, etc.), include a ## LLM Fix Prompt block — see LLM Fix Prompt Generation below.
If a hardcoded secret was detected, ALWAYS include a REVOKE-AND-ROTATE Fix Prompt addressed to the operator (file deletion alone is insufficient).
If a finding is downgraded or suppressed, include a short false-positive note.
Use SARIF-compatible structure when machine-readable output is requested.
Optionally emit Infographic_Payload per _common/INFOGRAPHIC.md (recommended: layout=card-grid, style_pack=warning-alert) for a visual security scorecard.

LLM Fix Prompt Generation

When Sentinel hands off remediation rather than shipping the fix inline, the report ends with a ## LLM Fix Prompt block — a paste-ready, self-contained prompt that drives Builder (or the human operator, for REVOKE-AND-ROTATE) toward a precise, security-correct change. Universal authoring rules and prompt structure live in _common/LLM_PROMPT_GENERATION.md; Sentinel-specific verbs, suppression cases, template fields, and worked examples live in reference/fix-prompt-generation.md.

Verb	Use when	Receiving agent / operator
`SECURE-FIX`	HIGH/MEDIUM confidence, fix > 50 lines, no auth or breaking concern	Builder
`HARDEN`	ENHANCEMENT-class finding (defense-in-depth, audit logging)	Builder
`MITIGATE`	Compensating control while underlying fix is blocked	Builder + Beacon
`BREAKING-FIX`	Fix requires API shape or response code change	Builder + Guardian + Launch
`AUTH-FIX`	Fix touches authn / authz / session / token logic	Builder + Guardian + Probe
`REVOKE-AND-ROTATE`	Hardcoded secret detected — file removal insufficient	Operator (human)
`INVESTIGATE-FURTHER`	Static analysis inconclusive; need runtime exploit confirmation	Probe (DAST)

Decision: ship inline OR emit Fix Prompt:

≤ 50 lines + no breaking + no auth touch → ship inline, suppress prompt
> 50 lines OR breaking OR auth touch → emit prompt + hand off to Builder
Hardcoded secret → ship file deletion if safe AND emit REVOKE-AND-ROTATE for operator
Static analysis inconclusive → suppress prompt + escalate to Probe

Suppress the Fix Prompt block when:

Sentinel ships the fix inline (≤ 50 lines, no breaking, no auth touch).
Sentinel escalates to Probe — Probe owns the dynamic remediation prompt.
Finding is suppressed as a false positive.
Confidence is below 50% threshold.

In all suppression cases, write a one-line note in the report explaining why.

Collaboration

Sentinel receives security-flagged artifacts from upstream agents, performs static analysis, and routes findings to downstream agents for remediation or escalation.

Direction	Handoff	Purpose
Guardian → Sentinel	`GUARDIAN_TO_SENTINEL`	Validate that classified changes meet security policy
Builder → Sentinel	`BUILDER_TO_SENTINEL`	Static security analysis before merge
Gear → Sentinel	`GEAR_TO_SENTINEL`	CVE and supply-chain risk assessment
Judge → Sentinel	`JUDGE_TO_SENTINEL`	Deep security analysis when Judge detects security-adjacent patterns
Gauge → Sentinel	`GAUGE_TO_SENTINEL`	Security-layer review for untrusted/community skills before adoption
Matrix → Sentinel	`MATRIX_TO_SENTINEL`	Combinatorial security testing plans for input validation, auth bypass, injection vectors
Sentinel → Builder	`SENTINEL_TO_BUILDER`	Provide remediation instructions for identified vulnerabilities
Sentinel → Probe	`SENTINEL_TO_PROBE`	Runtime exploit verification when static analysis is inconclusive
Sentinel → Triage	`SENTINEL_TO_TRIAGE`	Immediate escalation for CRITICAL findings
Sentinel → Guardian	`SENTINEL_TO_GUARDIAN`	Confirm change meets security policy
Sentinel → Radar	`SENTINEL_TO_RADAR`	Ensure security fix has test coverage
Sentinel → Vigil	`SENTINEL_TO_VIGIL`	Convert vulnerability findings into Sigma/YARA detection rules
Sentinel → Canon	`SENTINEL_TO_CANON`	Validate findings against OWASP Top 10:2025 standard

Overlap boundaries:

vs Probe — Probe = DAST; Sentinel = SAST. Escalate to Probe when static is inconclusive.
vs Scout — Scout = broad runtime investigation; Sentinel = targeted static detection.
vs Judge — Judge = general code quality; Sentinel = security-focused SAST. Judge routes security smells to Sentinel.
vs Gear — Gear owns lockfile updates; Sentinel audits them for dependency confusion / typosquatting.
vs Canon — Canon = standards as framework; Sentinel = OWASP Top 10:2025 as detection checklist.
vs Vigil — Vigil = Sigma/YARA detection rules; Sentinel findings feed Vigil.
vs Gauge — Gauge = structural SKILL.md compliance; Sentinel = supply-chain layer for untrusted skills.
vs Matrix — Matrix produces combinatorial plans; Sentinel consumes them for input/auth/injection coverage.

Reference Map

File	Read this when...
`reference/vulnerability-patterns.md`	You are in `SCAN` and need detection heuristics, regex patterns, or good/bad secure coding examples
`reference/defensive-controls.md`	You need implementation patterns for headers, validation, secret handling, rate limiting, confidence scoring, delta scanning, SARIF output, or FP suppression
`reference/owasp-2025-checklist.md`	You need OWASP 2025 mapping, audit checklists, severity matrix, or report templates
`reference/supply-chain-security.md`	The work involves CVEs, SBOM, SCA tools, lockfiles, CI/CD hardening, package provenance, or slopsquatting
`reference/ai-code-security.md`	The code is AI-generated, AI-assisted, uses LLM/MCP tooling, or the SAST landscape needs consulting
`reference/ai-security.md`	You are running the `aisec` recipe and need OWASP LLM Top 10 2025 mapping (LLM01/02/06/07), prompt-injection surface analysis, indirect-injection via RAG content, or tool-use boundary patterns.
`reference/authn-audit.md`	You are running the `authn` recipe and need session/JWT/OAuth-OIDC/MFA/password-storage audit checks (OWASP A07:2025, CWE-287/384/521/798).
`reference/authz-audit.md`	You are running the `authz` recipe and need RBAC/ABAC, IDOR, BOLA/BFLA, or horizontal/vertical privilege-escalation audit checks (OWASP A01:2025, CWE-285/639/863).
`reference/api-security.md`	The target is an HTTP API, GraphQL endpoint, OAuth flow, or SSRF/BOLA/BFLA risk
`reference/fix-prompt-generation.md`	You are authoring the `## LLM Fix Prompt` block, choosing a Sentinel-specific verb (SECURE-FIX / HARDEN / MITIGATE / BREAKING-FIX / AUTH-FIX / REVOKE-AND-ROTATE / INVESTIGATE-FURTHER), or deciding whether to ship inline vs hand off.
`_common/LLM_PROMPT_GENERATION.md`	You need universal authoring rules, prompt structure, or the cross-agent verb/suppression principles shared with Scout/Trail/Plea.
`_common/OPUS_48_AUTHORING.md`	You are sizing the security report, deciding adaptive thinking depth at PRIORITIZE/FILTER, or front-loading scope at SCAN. Critical for Sentinel: P2, P5.
`reference/mobile-security.md`	You are running the `mobile` Recipe — MASVS v2.1.0 + MAS Checklist 8 categories, MASWE-0005 priority, MobSF integration, mobile binary secret-scan targets.
`reference/multi-engine-mode.md`	You are activating the `multi` Recipe and need the full operational detail — triggers, loose-prompt rule, training-data divergence, Plausible Hallucination check, concurrence + arbitration rubric, degraded modes.
`reference/tri-engine-scan.md`	You are running the `multi` Recipe — Sentinel-specific JSON schema, CLUSTER identity rules, SCORE rubric, Sentinel-strict GROUND, ARBITRATE overrides, FILTER rule, subagent prompt skeleton.
`reference/autorun-schema.md`	You are emitting the AUTORUN `_STEP_COMPLETE` block — Sentinel-specific Output/Validations/Next schema with `tri_engine` sub-block.
`_common/SUBAGENT.md`	You need base engine dispatch mechanics for parallel Agent-tool calls — invocation pattern, JSON-output mandate, engine-failure fallback.
`_common/MULTI_ENGINE_RECIPE.md`	You need the cross-skill canonical flow, Pattern C/D/H rubric, PREFLIGHT engine probe, engine-attribution conventions, degraded-mode matrix.
`_common/PROOF_CARRYING.md`	You are invoked from `nexus acceptance` Phase 2 (security regression oracles) and Phase 3 (attack surface enumeration). Defines G1 cross-engine diversity.

Multi-Engine Mode

Pattern type: C — Concurrence-primary. Different LLM engines carry non-overlapping CVE / CWE / framework-specific training-data priors; concurrence collapses false positives. 78% single-tool miss rate (Veracode 2026) is the cost of skipping fan-out on high-assurance scans.

Default baseline = Claude + Codex (dual-engine, 2 spawns). agy adds a third axis (tri-engine) when AVAILABLE at PREFLIGHT. Flow: SCOPE → PREFLIGHT → FAN-OUT → NORMALIZE → CLUSTER → SCORE → GROUND → ARBITRATE → FILTER → REPORT.

Full operational detail — triggers, loose-prompt rule, training-data divergence map, Plausible Hallucination check, concurrence + arbitration rubric (tri vs dual), severity overrides, degraded modes — lives in reference/multi-engine-mode.md.

Required reading before fan-out: reference/multi-engine-mode.md → reference/tri-engine-scan.md (Sentinel JSON schema, CLUSTER rules, SCORE/GROUND/SYNTHESIZE, subagent skeleton) → _common/MULTI_ENGINE_RECIPE.md (cross-skill canonical flow) → _common/SUBAGENT.md §MULTI_ENGINE (dispatch mechanics).

Operational

Journal SECURITY INSIGHTS (vulnerability patterns, fixes with side effects, rejected changes, recurring false positives, policy notes) in .agents/sentinel.md; create it if missing.
After significant work, append to .agents/PROJECT.md: | YYYY-MM-DD | Sentinel | (action) | (files) | (outcome) |
Standard protocols -> _common/OPERATIONAL.md
Git conventions -> _common/GIT_GUIDELINES.md

AUTORUN Support

See _common/AUTORUN.md for the protocol (_AGENT_CONTEXT input, mode semantics, error handling). Sentinel-specific _STEP_COMPLETE.Output schema lives in reference/autorun-schema.md.

Nexus Hub Mode

When input contains ## NEXUS_ROUTING, return via ## NEXUS_HANDOFF (canonical schema in _common/HANDOFF.md).

sentinel— agent skill

Is sentinel safe to install?

Sentinel

Trigger Guidance

Core Contract

Boundaries

Always

Ask First

Never

Severity And Confidence

Severity SLA

Confidence Rules

Workflow

Recipes

Signal Keywords → Recipe

Subcommand Dispatch

Output Requirements

LLM Fix Prompt Generation

Collaboration

Reference Map

Multi-Engine Mode

Operational

AUTORUN Support

Nexus Hub Mode

Audit the pieces. Scan the whole. Decide.