Sentinel CUSTOM_PROVIDERS Redaction Check

• Outcome: Pass
• Latest audit: Aug 19, 2026 · 11:13 PM UTC
• Version: 1.0.1

Overview

This skill performs the disclosed Sentinel redaction test, but users should understand it restarts the local gateway and can optionally send failure details to Telegram.

Install only if you are comfortable letting the skill stop and restart your local Sentinel gateway, point it at the configured custom backend, and optionally send the check result to Telegram. Leave the Telegram variables unset for local-only stdout reporting, and avoid running it during active gateway use unless a restart is acceptable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill directs the operator to run shell commands, consume environment variables, and make network calls, yet the skill file declares no permissions or equivalent capability boundaries. That creates a confused-deputy risk where a user or platform may treat the skill as low-privilege even though it can stop/start containers, contact external endpoints, and access sensitive configuration from `.env` values.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose is a local redaction verification workflow, but the behavior also transmits probe results and backend response details to Telegram and advertises a triggerable command entrypoint. That mismatch is dangerous because users may consent to a local diagnostic check without realizing test data, backend metadata, or failure details can be sent to an external messaging service or exposed through a remotely invokable workflow.

External Transmission

Medium

• Category: Data Exfiltration

Content

print("[skill] TELEGRAM_BOT_TOKEN or TELEGRAM_CHAT_ID not set — skipping alert.")
        return False
    try:
        resp = requests.post(
            f"https://api.telegram.org/bot{token}/sendMessage",
            json={"chat_id": chat_id, "text": message, "parse_mode": "HTML"},
            timeout=10,

• Confidence: 89% confidence
• Finding: The skill sends a Telegram message that, on failure, includes backend name/base URL and up to 400 characters of raw backend response content. If the redaction check fails exactly because sensitive content reached the backend, this alert can retransmit that leaked content to Telegram, expanding the exposure beyond the local test path.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31
python-dotenv>=1.0

• Confidence: 90% confidence
• Finding: The dependency is specified with only a lower bound, which allows future installs to resolve to different versions over time. This weakens reproducibility and can silently introduce vulnerable or incompatible releases into a security-sensitive skill that proxies requests to external/custom backends.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31
python-dotenv>=1.0

• Confidence: 90% confidence
• Finding: Using an unpinned version for python-dotenv means deployments may pick up unexpected future releases, including ones with security regressions. In a skill likely handling environment-based configuration and secrets, dependency drift increases operational and security risk.

Known Vulnerable Dependency: requests==2.31 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The finding indicates the allowed dependency includes requests 2.31, which has published advisories including credential leakage via malicious URLs and request verification issues. Because this skill appears to send probes through custom/self-hosted HTTP endpoints, flaws in the HTTP client are more relevant than in a purely local tool and could expose credentials or weaken transport assurances.

Known Vulnerable Dependency: python-dotenv==1.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: The allowed dependency includes python-dotenv 1.0, which is flagged for symlink-following/arbitrary file overwrite behavior in set_key-related functionality. If the skill or adjacent tooling ever writes .env files in environments where filesystem paths can be influenced, this could become a local file integrity issue; the secret-handling nature of the skill makes dotenv-related weaknesses more concerning.

Static analysis

No suspicious patterns detected.