sentinel-proxy

• Outcome: Review
• Latest audit: Aug 1, 2026 · 3:07 AM UTC
• Version: 1.0.1

Overview

This skill is an AI firewall, but it needs review because it sends full prompts, tool inputs, tool responses, and optionally all LLM traffic to Sentinel while silently passing traffic through if Sentinel is unavailable.

Install only if you are comfortable sending prompts, tool inputs, tool outputs, and optional full LLM proxy traffic to Sentinel's service. Avoid using it with regulated, secret, or proprietary data unless Sentinel's retention, logging, and compliance terms are acceptable, and understand that when the service or key fails the hooks may let traffic continue unscanned.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation instructs users to export environment variables and run shell commands, indicating shell capability, but no corresponding permissions are declared. Undeclared execution capability weakens the trust model because users and platforms cannot accurately assess what the skill may do during setup or runtime, especially for a security-sensitive proxy skill that handles credentials and traffic routing.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script advertises credential verification before agent startup, but it explicitly exits 0 in all cases, including missing credentials, unreachable service, and invalid keys. In the context of an AI firewall skill, this creates a fail-open condition where operators may believe prompt-injection and exfiltration defenses are active when they are actually disabled, allowing unfiltered agent execution.

Intent-Code Divergence

Low

• Confidence: 86% confidence
• Finding: The success message states that both inbound and outbound scanning are active, but the bootstrap only performs a single probe to one scrub endpoint using fixed test content. This can mislead users into believing broader protections were validated, reducing scrutiny and causing unsafe reliance on controls that may not actually be enabled or functioning.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The recommended transparent proxy mode routes all LLM traffic through Sentinel's external service, including prompts, tool-related content, and potentially sensitive session data, but the description does not prominently warn users about this data transfer and trust boundary change. This can lead users to unknowingly send secrets, proprietary information, or regulated data to a third party under the assumption the skill operates purely locally.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: When enabled, this hook serializes the full toolInput and sends it to a third-party Sentinel endpoint before any external tool call. Because toolInput can contain secrets, personal data, proprietary prompts, or file contents, this creates a real data-export path that may exceed user expectations and can leak sensitive data to an external service even when the downstream tool call is later blocked.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script transmits the full user prompt content to a third-party Sentinel API for scanning, but there is no disclosure, consent check, minimization, or redaction in this file. Because user prompts may contain secrets, personal data, or proprietary information, this creates a real confidentiality and compliance risk if operators enable the skill without understanding that data leaves their environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(json.dumps({'content': sys.argv[1], 'tier': sys.argv[2]}))
" "$content" "$SENTINEL_TIER")

response=$(curl -sf \
  -X POST "${SENTINEL_API_URL}/v1/scrub" \
  -H "X-Sentinel-Key: ${SENTINEL_KEY}" \
  -H "Content-Type: application/json" \

• Confidence: 97% confidence
• Finding: This script sends the full toolResponse content to an external Sentinel API for inspection, which is a real data-exfiltration boundary. Tool results can contain secrets, credentials, proprietary data, or user content from other skills/tools, so transmitting them off-host introduces confidentiality and compliance risk if the endpoint is compromised, misconfigured, or not explicitly trusted by the deployer.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(json.dumps({'content': sys.argv[1], 'tier': sys.argv[2]}))
" "$content" "$SENTINEL_TIER")

response=$(curl -sf \
  -X POST "${SENTINEL_API_URL}/v1/scrub" \
  -H "X-Sentinel-Key: ${SENTINEL_KEY}" \
  -H "Content-Type: application/json" \

• Confidence: 97% confidence
• Finding: The curl call posts the full scrub payload to an external URL, and that payload contains the complete serialized toolInput. In an agent setting, toolInput is often exactly where sensitive outbound data accumulates, so this firewall introduces its own exfiltration channel to a remote service and broadens the trust boundary to the Sentinel API and anyone with access to its logs or infrastructure.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(json.dumps({'content': sys.argv[1], 'tier': sys.argv[2]}))
" "$content" "$SENTINEL_TIER")

response=$(curl -sf \
  -X POST "${SENTINEL_API_URL}/v1/scrub" \
  -H "X-Sentinel-Key: ${SENTINEL_KEY}" \
  -H "Content-Type: application/json" \

• Confidence: 93% confidence
• Finding: At the curl call, the script sends prompt content and tier metadata to an external service endpoint, which is a genuine outbound data flow. In an AI firewall skill this behavior is expected functionally, but it still expands the trust boundary and can expose sensitive prompt contents to a remote provider, especially since failures default to pass-through and there is no integrity, allowlist, or explicit environment suitability check here beyond the configurable URL.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.