AI Sentinel - Prompt Injection Firewall

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:13 PM UTC
• Version: 0.2.2

Overview

The skill is mostly transparent, but it installs an unpinned third-party gateway plugin that can inspect agent messages, tool calls, and tool results.

Review the npm package provenance before installing, and prefer a pinned command such as `ai-sentinel@0.2.1` if supported. Use Community mode if you want local-only scanning. If enabling Pro, confirm whether raw message content will be sent and store the API key only in an ignored local `.env` file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:52

Finding

Unpinned Third-Party Plugin Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 9)May include surrounding context.

md

- Declare `~/.openclaw/openclaw.json` in `writes-files` — the Step 5 plugin-config merge writes this file (still gated behind explicit user confirmation). Resolves the scope-creep finding where an instructed write exceeded declared file permissions.
- Rework the Test 2 verification step to describe the prompt-injection probe rather than embedding the literal directive in the manifest, so it is not mistaken for an instruction to the reviewing agent. Restores the "benign-to-scan" convention from 1.0.1.
- Update skill card and README file-write declarations to match.

## 0.2.1 (2026-08-27)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

installs-packages:
  - ai-sentinel
writes-files:
  - .env
  - .gitignore
  - ~/.openclaw/openclaw.json  # plugin config merge (Step 5), only after explicit user confirmation
external-services:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

4. Ensure .env is in .gitignore:

   bash

   echo ".env" >> .gitignore
   

   (Only add if not already present. Use Grep to check first.)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

- **Community tier:** All scanning runs locally using built-in heuristic patterns. No data leaves your machine.
- **Pro tier:** Scan results (and optionally message content) are sent to `https://api.zetro.ai` for dashboard reporting and analytics. Review the [privacy policy](https://zetro.ai/privacy) and [plugin source](https://www.npmjs.com/package/ai-sentinel) before enabling Pro.

### File Write Policy

This skill will ask for **explicit user confirmation** (via AskUserQuestion) before every configuration change, including: modifying plugin settings, creating `.env`, and updating `.gitignore`. No files are written without user approval.

Static analysis

No suspicious patterns detected.