Sentinel Modality-Router Redaction Check

• Outcome: Pass
• Latest audit: Aug 24, 2026 · 8:43 PM UTC
• Version: 1.0.1

Overview

This skill is an active local Sentinel gateway redaction test whose disruptive and external-reporting behaviors are clearly disclosed and fit its purpose.

Install only where the operator is allowed to restart the local Sentinel gateway. Leave Telegram variables blank if third-party reporting is not acceptable, and avoid adapting the probe to use real user prompts unless outbound snippets are removed or redacted. Use current patched dependency versions within the declared ranges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill has material capabilities beyond a passive check: it uses environment secrets, performs network egress, and invokes shell/subprocess operations, yet no explicit permission declaration is present. That gap increases the chance an operator or automation framework will run it with insufficient understanding that it can restart infrastructure and send data externally, which is a real security and availability risk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The top-level description frames the skill as a verification check, but the documented behavior includes stopping and restarting the local Sentinel gateway, changing a security-control configuration, and optionally exfiltrating response snippets to Telegram. That mismatch is dangerous because users or orchestrators may authorize a seemingly read-only diagnostic while actually granting a state-changing operation with availability impact and outbound data flow.

External Transmission

Medium

• Category: Data Exfiltration

Content

print("[skill] TELEGRAM_BOT_TOKEN or TELEGRAM_CHAT_ID not set -- skipping alert.")
        return False
    try:
        resp = requests.post(
            f"https://api.telegram.org/bot{token}/sendMessage",
            json={"chat_id": chat_id, "text": message, "parse_mode": "HTML"},
            timeout=10,

• Confidence: 87% confidence
• Finding: The skill sends probe results to Telegram, an external third-party service, which creates an outbound data egress path from the local environment. While the probe data is synthetic by design, the failure path includes raw backend-generated content snippets, and configuration or future modifications could cause sensitive information, model output, or internal metadata to leave the environment unintentionally.

External Transmission

Medium

• Category: Data Exfiltration

Content

return False
    try:
        resp = requests.post(
            f"https://api.telegram.org/bot{token}/sendMessage",
            json={"chat_id": chat_id, "text": message, "parse_mode": "HTML"},
            timeout=10,
        )

• Confidence: 90% confidence
• Finding: Hardcoded use of the Telegram API confirms intentional exfiltration of execution results to an external endpoint outside the local trust boundary. In this skill's context that behavior is part of the advertised functionality, but it still increases risk because operational details and any included output are sent to a third-party cloud service.

Known Vulnerable Dependency: requests==2.31 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The dependency specification permits requests 2.31.x, and the supplied finding indicates that version line is affected by multiple published advisories. Even if this file does not pin exactly 2.31.0, allowing a known vulnerable major/minor range can result in installation of an affected release, which is risky for a skill that may make HTTP requests and could process attacker-controlled URLs or network responses.

Known Vulnerable Dependency: python-dotenv==1.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: The requirement allows python-dotenv 1.0.x, and the finding states that this line is associated with advisories involving unsafe file handling such as symlink following during set_key operations. If the skill writes or modifies .env files in environments where filesystem paths can be influenced, this could enable unintended file overwrite or similar local-impact issues.

Static analysis

No suspicious patterns detected.