Sentinel — Agent Security Layer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:25 AM UTC
• Version: 1.0.5

Overview

This is a coherent security-scanning skill, but it can store sensitive detected content in plaintext logs and its advertised sanitization/interception coverage is stronger than what the scripts actually provide.

Install only if you are comfortable reviewing and adjusting the scripts first. Treat it as a helper scanner, not a complete runtime security boundary. Disable or change raw snippet logging before scanning secrets, avoid forwarding --clean output as trusted content, and verify which pattern file is actually loaded.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sentinel-output.sh:297
• Finding: Detected sensitive content is persisted in plaintext audit logs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/sentinel-input.sh:463-476`; `scripts/sentinel-output.sh:297-301` **Vulnerability Type**: Plaintext storage of sensitive data **Risk Level**: High ### Vulnerable Code `scripts/sentinel-input.sh:463-476`: ```bash if [[ $THREAT_COUNT -gt 0 ]]; then mkdir -p "$(dirname "$SENTINEL_LOG")" SNIPPET=$(echo "$INPUT" | head -c 200 | tr '\n' ' ') LOG_ENTRY=$(cat <<EOF {"timestamp":"$(date -u +%Y-%m-%dT%H:%M:%SZ)","direction":"input","severity":"$SEVERITY","categories":"$CAT_STRING","threat_count":$THREAT_COUNT,"snippet":"$(echo "$SNIPPET" | sed 's/"/\\"/g')","action":"$(if [[ "$CLEAN_MODE" == true ]]; then echo "sanitized"; else echo "blocked"; fi)"} EOF ) echo "$LOG_ENTRY" >> "$SENTINEL_LOG" 2>/dev/null || true fi ``` `scripts/sentinel-output.sh:297-301`: ```bash if [[ $THREAT_COUNT -gt 0 ]]; then mkdir -p "$(dirname "$SENTINEL_LOG")" SNIPPET=$(echo "$INPUT" | head -c 200 | tr '\n' ' ') LOG_ENTRY="{\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"direction\":\"output\",\"severity\":\"$SEVERITY\",\"categories\":\"$CAT_STRING\",\"threat_count\":$THREAT_COUNT,\"snippet\":\"$(echo "$SNIPPET" | sed 's/"/\\"/g')\"}" echo "$LOG_ENTRY" >> "$SENTINEL_LOG" 2>/dev/null || true fi ``` ### Technical Analysis The input and output scanners are specifically intended to detect credentials, private keys, tokens, database connection strings, and other confidential content. When a threat is found, both scanners copy the first 200 characters of the original content into `~/.sentinel/threats.jsonl` by default. Consequently, if sensitive material appears within the first 200 characters, the scanner creates a second plaintext copy of the material it was intended to protect. The code creates the log directory and file without setting an explicit restrictive `umask` or applying `0700` and `0600` permissions. Actual exposure depends on the invoking process's existing `umask`, directory permissions, backup poli ...[truncated 1640 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not store raw input or output snippets for security detections. Log only: - Timestamp. - Direction. - Severity. - Detection category. - Rule identifier. - Content length. 2. If event correlation is necessary, use a keyed HMAC over the content rather than a reversible or plain hash. 3. Set restrictive permissions before creating any Sentinel files: ```bash umask 077 mkdir -p -m 700 "$(dirname "$SENTINEL_LOG")" touch "$SENTINEL_LOG" chmod 600 "$SENTINEL_LOG" ``` 4. Validate that a custom `SENTINEL_LOG` path is owned by the expected user and is not a symbolic link before writing. 5. Implement log retention and secure deletion policies. 6. Use a real JSON serializer, such as `jq -n --arg`, if arbitrary text ever needs to be represented in a log. 7. Add automated tests confirming that representative API keys, JWTs, private keys, and database URIs never appear in the log. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sentinel-input.sh:491
• Finding: The clean mode can emit content that still contains detected attack instructions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/sentinel-input.sh:491-497` **Vulnerability Type**: Incomplete sanitization and fail-open content handling **Risk Level**: High ### Vulnerable Code ```bash if [[ "$CLEAN_MODE" == true ]]; then echo "" echo "--- SANITIZED OUTPUT (threats stripped) ---" CLEANED="$INPUT" for pattern in "${INJECTION_PATTERNS[@]}" "${EXFIL_PATTERNS[@]}" "${CMD_PATTERNS[@]}" "${SE_PATTERNS[@]}"; do CLEANED=$(echo "$CLEANED" | sed -E "s/$pattern/[REDACTED]/gI" 2>/dev/null || echo "$CLEANED") done echo "$CLEANED" fi ``` ### Technical Analysis Detection is performed against several representations and rule sets, including: - Base64-decoded text appended to `NORMALIZED`. - Zero-width-character normalization. - HTML-stripped content. - Space-collapsed and leetspeak-normalized variants. - Multilingual prompt-injection arrays. - Extended injection, exfiltration, and command-injection arrays. - Optional premium pattern categories. The `--clean` implementation does not sanitize against all of those rules. It applies only four basic arrays—`INJECTION_PATTERNS`, `EXFIL_PATTERNS`, `CMD_PATTERNS`, and `SE_PATTERNS`—to the original, unnormalized `INPUT`. A payload detected only after decoding or normalization, or one matched by an extended, multilingual, or premium rule, may therefore be labeled CRITICAL while remaining unchanged in the section explicitly labeled `SANITIZED OUTPUT`. A caller that extracts and forwards this section can expose the downstream agent to content the scanner already identified as hostile. Regex replacement is also insufficient for reliably neutralizing semantic prompt injection. Removing a matched substring does not guarantee that the remaining text is safe. ### Attack Path 1. An attacker supplies external content containing a payload matched only by an extended, multilingual, encoded, normalized, or premium signature. 2. The detection phase identifies the payload and assigns HIGH or ...[truncated 1220 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Fail closed for all HIGH and CRITICAL detections. Do not emit attacker-controlled content as sanitized output by default. 2. Replace `--clean` with a structured result that separates status and content, and omit content entirely when a serious threat is detected. 3. If sanitization remains supported: - Track exact source spans for every match. - Include all basic, multilingual, extended, and loaded premium rules. - Map normalized or decoded matches back to their original source ranges. - Rescan the final output through the complete detection pipeline. - Release the content only if the second scan reports CLEAN. 4. Do not rely on broad regex substitution to neutralize semantic prompt injection. Prefer blocking, quarantine, or explicit allow-list extraction. 5. Add regression tests covering Base64 payloads, zero-width obfuscation, leetspeak, all supported languages, extended signatures, and premium signatures. 6. Clearly document that a nonzero exit status takes precedence over any text written to standard output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/sentinel-premium-check.sh:19
• Finding: The bundled pattern pack is not loaded under its documented filename<![CDATA[ ## Vulnerability Details **File Location**: `patterns/patterns.json:2-7`; `scripts/sentinel-premium-check.sh:19-27` **Vulnerability Type**: Security configuration and detection coverage mismatch **Risk Level**: Medium ### Vulnerable Code `patterns/patterns.json:2-7`: ```json "_meta": { "name": "Claw Sentinel Patterns Pack", "version": "1.0.0", "updated": "2026-03-14", "total_patterns": 512, "docs": "Drop this file into ~/.sentinel/ and it will be loaded automatically" } ``` `scripts/sentinel-premium-check.sh:19-27`: ```bash # Find premium patterns PREMIUM_FILE="" if [[ -f "$HOME/.sentinel/premium_patterns.json" ]]; then PREMIUM_FILE="$HOME/.sentinel/premium_patterns.json" elif [[ -f "$SKILL_DIR/patterns/premium_patterns.json" ]]; then PREMIUM_FILE="$SKILL_DIR/patterns/premium_patterns.json" fi if [[ -z "$PREMIUM_FILE" ]]; then ``` ### Technical Analysis The project ships `patterns/patterns.json`, and its metadata states that dropping “this file” into `~/.sentinel/` loads it automatically. The only external-pattern loader inspected by the audit searches exclusively for: - `~/.sentinel/premium_patterns.json` - `<skill directory>/patterns/premium_patterns.json` It never searches for `patterns.json`. The bundled file is therefore not loaded under either its packaged name or the name implied by its embedded documentation. This leaves categories present only in the bundled database—such as additional metadata-SSRF, filesystem, encoding-evasion, multilingual, and advanced attack signatures—inactive unless an operator manually renames the file to an undocumented loader-specific name. This is a detection-coverage failure rather than code execution. The JSON entries are inert regular expressions interpreted by `jq` and `grep`; the audit found no decode-and-execute behavior in the pattern pack. ### Attack Path 1. An operator installs or copies the bundled `patterns/patterns.json` according to the package layout or embedded instructio ...[truncated 974 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Load the packaged filename directly: ```bash if [[ -f "$HOME/.sentinel/patterns.json" ]]; then PREMIUM_FILE="$HOME/.sentinel/patterns.json" elif [[ -f "$SKILL_DIR/patterns/patterns.json" ]]; then PREMIUM_FILE="$SKILL_DIR/patterns/patterns.json" fi ``` 2. Alternatively, rename the bundled file to `premium_patterns.json` and update all installation instructions consistently. 3. Document the exact lookup order and whether local user files override packaged files. 4. Validate the JSON schema, category names, severity values, and regex syntax before accepting a pattern pack. 5. Report an explicit warning when a bundled or configured pattern pack cannot be loaded instead of silently continuing. 6. Add integration tests proving that representative signatures from every bundled category are active after the documented installation procedure. 7. Display the loaded pattern-pack path and version in diagnostic output so operators can verify coverage. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (39)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match

Content

خطى (قيود|حماية) الأمان"
  )

  for pattern in "${AR_PATTERNS[@]}"; do
    if echo "$NORMALIZED" | grep -qP "$pattern"; then
      THREATS+=("prompt_injection_ar: matched")
      CATEGORIES+=("prompt_injection")
      update_severity "CRITICAL"
    fi
  done
fi

# --- DATA EXFILTRATION ---
if [[ "$SENTINEL_CHECK_EXFIL" == true ]]; then
  EXFIL_PATTERNS=(
    "webhook\.site"
    "requestbin\.(com|net)"
    "ngrok\.(io|app)"
    "burpcollaborator\.net"
    "interact\.sh"
    "oastify\.com"
    "canarytokens\.com"
    "pipedream\.net"
    "hookbin\.com"
    "169\.254\.169\.254"
    "metadata\.google\.internal"
    "100\.100\.100\.200"
    "fd00:ec2::254"
    "curl [^|]*\| ?(bash|sh|zsh|source)"
    "wget [^&]*&& ?(bash|sh|chmod)"
    "fetch\(['\"][^'\"]*\.(sh|py|rb|pl)"
  )

  for pattern in "${EXFIL_PATTERNS[@]}"; do
    if echo "$LOWER" | grep -qPi "$pattern"; then
      THREATS+=("data_exfil: matched '$pattern'")
      CATEGORIES+=("data_exfil")
      update_severity

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

YARA rule 'reverse_shell': Reverse shell patterns in scripts or source code [malware]

Critical

• Category: YARA Match

Content

"chmod (777|666|u\+s)"
    "mkfs\."
    "dd if=/dev/(zero|random|urandom) of=/"
    ":(){ :\|:& };:"
    "\beval\b.*\\\$"
    "python[23]? -c ['\"].*exec"
    "base64 -d.*\| ?(bash|sh|python|perl|ruby)"
    "echo [A-Za-z0-9+/]*= *\| *base64 -d"
    "curl.*-o.*/tmp/.*&&.*chmod"
    "wget.*-O.*/tmp/.*&&.*chmod"
    "\bsudo\b.*\b(rm|chmod|chown|mv|dd|mkfs)\b"
    "nc -[elp]"
    "/dev/tcp/"
    "bash -i >& /dev/tcp/"
    "reverse.?shell"
  )

  for pattern in "${CMD_PATTERNS[@]}"; do
    if echo "$LOWER" | grep -qPi "$pattern"; then
      THREATS+=("command_injection: matched '$pattern'")
      CATEGORIES+=("command_injection")
      update_severity "CRITICAL"
    fi
  done
fi

# --- SOCIAL ENGINEERING ---
if [[ "$SENTINEL_CHECK_SOCIAL_ENG" == true ]]; then
  SE_PATTERNS=(
    "please (run|execute|install|type|enter|paste|copy).*\b(curl|wget|pip|npm|brew|apt|yum|bash|sh|python)\b"
    "run (this|the following) (command|script|installer)"
    "install (this|the) (dependency|prerequisit

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Claiming broad multilingual injection detection, pre-processing interception across many content sources, and exfiltration protection without implementing those features can mislead users operating in hostile environments. In security tooling, incomplete coverage presented as comprehensive defense is itself a meaningful vulnerability because it changes operator decisions and exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: Claiming broad multilingual injection detection, pre-processing interception across many content sources, and exfiltration protection without implementing those features can mislead users operating in hostile environments. In security tooling, incomplete coverage presented as comprehensive defense is itself a meaningful vulnerability because it changes operator decisions and exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Claiming broad multilingual injection detection, pre-processing interception across many content sources, and exfiltration protection without implementing those features can mislead users operating in hostile environments. In security tooling, incomplete coverage presented as comprehensive defense is itself a meaningful vulnerability because it changes operator decisions and exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Claiming broad multilingual injection detection, pre-processing interception across many content sources, and exfiltration protection without implementing those features can mislead users operating in hostile environments. In security tooling, incomplete coverage presented as comprehensive defense is itself a meaningful vulnerability because it changes operator decisions and exposure.

Ae1

High

• Category: analysis-evasion

Content

echo "sample_input.txt" | scripts/sentinel-input.sh

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

echo "sample_input.txt" | scripts/sentinel-input.sh

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

echo "sample_input.txt" | scripts/sentinel-input.sh

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

echo "sample_input.txt" | scripts/sentinel-input.sh

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

echo "sample_input.txt" | scripts/sentinel-input.sh

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

echo "$AGENT_RESPONSE" | scripts/sentinel-output.sh

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Cloud Metadata Access

High

• Category: Server-Side Request Forgery

Content

**Data Exfiltration**
- Suspicious endpoints: webhook.site, requestbin, ngrok
- Cloud metadata: 169.254.169.254
- Encoded URLs, hidden curl/fetch commands

**Secret Leakage (output)**

• Confidence: 90% confidence
• Finding: Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Ae6

High

• Category: analysis-evasion
• Confidence: 90% confidence
• Finding: Instruction text uses inter-character separators to evade pattern matching

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

OMPT INJECTION (EN) ---
if [[ "$SENTINEL_CHECK_INJECTION" == true ]]; then
  INJECTION_PATTERNS=(
    "ignore (all |your )?previous (instructions|context|rules|directives)"
    "ignore (all |your )?prior (instructions|context|rules)"
    "disregard (all |your )?(previous|prior|above) (instructions|rules|context)"
    "forget (all |your )?(previous|prior|earlier) (instructions|context|rules)"
    "you are now (in )?(developer|debug|admin|god|unrestricted|jailbreak) mode"
    "you are (now )?dan"
    "act as (an )?unrestricted"
    "override (all )?safety"
    "bypass (all )?(safety|security|content|moderation)"
    "enter (developer|debug|admin|maintenance) mode"
    "system prompt (is|says|contains|override)"
    "reveal (your|the) (system|original|initial) (prompt|instructions)"
    "repeat (your|the) (system|original) (prompt|instructions)"
    "print (your|the) (system|original) (prompt|instructions)"
    "what (is|are) your (system |original |initial )?(prompt|instructions|rules)"

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

"forget (all |your )?(previous|prior|earlier) (instructions|context|rules)"
    "you are now (in )?(developer|debug|admin|god|unrestricted|jailbreak) mode"
    "you are (now )?dan"
    "act as (an )?unrestricted"
    "override (all )?safety"
    "bypass (all )?(safety|security|content|moderation)"
    "enter (developer|debug|admin|maintenance) mode"

• Confidence: 85% confidence
• Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match

Content

for pattern in "${AR_PATTERNS[@]}"; do
    if echo "$NORMALIZED" | grep -qP "$pattern"; then
      THREATS+=("prompt_injection_ar: matched")
      CATEGORIES+=("prompt_injection")
      update_severity "CRITICAL"
    fi
  done
fi

# --- DATA EXFILTRATION ---
if [[ "$SENTINEL_CHECK_EXFIL" == true ]]; then
  EXFIL_PATTERNS=(
    "webhook\.site"
    "requestbin\.(com|net)"
    "ngrok\.(io|app)"
    "burpcollaborator\.net"
    "interact\.sh"
    "oastify\.com"
    "canarytokens\.com"
    "pipedream\.net"
    "hookbin\.com"
    "169\.254\.169\.254"
    "metadata\.google\.internal"
    "100\.100\.100\.200"
    "fd00:ec2::254"
    "curl [^|]*\| ?(bash|sh|zsh|source)"
    "wget [^&]*&& ?(bash|sh|chmod)"
    "fetch\(['\"][^'\"]*\.(sh|py|rb|pl)"
  )

  for pattern in "${EXFIL_PATTERNS[@]}"; do
    if echo "$LOWER" | grep -qPi "$pattern"; then
      THREATS+=("data_exfil: matched '$pattern'")
      CATEGORIES+=("data_exfil")
      update_severity "CRITICAL"
    fi
  done
fi

# --- COMMAND INJECTI

• Confidence: 70% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Cloud Metadata Access

High

• Category: Server-Side Request Forgery

Content

"169\.254\.169\.254"
    "metadata\.google\.internal"
    "100\.100\.100\.200"
    "fd00:ec2::254"
    "curl [^|]*\| ?(bash|sh|zsh|source)"
    "wget [^&]*&& ?(bash|sh|chmod)"
    "fetch\(['\"][^'\"]*\.(sh|py|rb|pl)"

• Confidence: 85% confidence
• Finding: Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Cloud Metadata Access

High

• Category: Server-Side Request Forgery

Content

"169\.254\.169\.254"
    "metadata\.google\.internal"
    "100\.100\.100\.200"
    "fd00:ec2::254"
    "curl [^|]*\| ?(bash|sh|zsh|source)"
    "wget [^&]*&& ?(bash|sh|chmod)"
    "fetch\(['\"][^'\"]*\.(sh|py|rb|pl)"

• Confidence: 85% confidence
• Finding: Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

External Script Fetching

High

• Category: Supply Chain

Content

"100\.100\.100\.200"
    "fd00:ec2::254"
    "curl [^|]*\| ?(bash|sh|zsh|source)"
    "wget [^&]*&& ?(bash|sh|chmod)"
    "fetch\(['\"][^'\"]*\.(sh|py|rb|pl)"
  )

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# --- COMMAND INJECTION ---
if [[ "$SENTINEL_CHECK_COMMANDS" == true ]]; then
  CMD_PATTERNS=(
    "rm -rf [/~]"
    "chmod (777|666|u\+s)"
    "mkfs\."
    "dd if=/dev/(zero|random|urandom) of=/"

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

if [[ "$SENTINEL_CHECK_COMMANDS" == true ]]; then
  CMD_PATTERNS=(
    "rm -rf [/~]"
    "chmod (777|666|u\+s)"
    "mkfs\."
    "dd if=/dev/(zero|random|urandom) of=/"
    ":(){ :\|:& };:"

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

"python[23]? -c ['\"].*import (os|subprocess|socket)"
    "node -e ['\"].*child_process"
    "perl -e ['\"].*system"
    "echo .* >> ~/\.ssh/authorized_keys"
    "curl -d .*\\\$\(env\)"
    "curl -d .*\\\$\(cat "
  )

• Confidence: 90% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

$pattern"; then
      THREATS+=("data_exfil_ext: matched '$pattern'")
      CATEGORIES+=("data_exfil")
      update_severity "HIGH"
    fi
  done
fi

# --- EXTENDED COMMAND INJECTION ---
if [[ "$SENTINEL_CHECK_COMMANDS" == true ]]; then
  EXT_CMD=(
    ":\(\)\{ :\|:& \};:"
    "python[23]? -c ['\"].*import (os|subprocess|socket)"
    "node -e ['\"].*child_process"
    "perl -e ['\"].*system"
    "echo .* >> ~/\.ssh/authorized_keys"
    "curl -d .*\\\$\(env\)"
    "curl -d .*\\\$\(cat "
  )

  for pattern in "${EXT_CMD[@]}"; do
    if echo "$LOWER" | grep -qPi "$pattern"; then
      THREATS+=("command_injection_ext: matched '$pattern'")
      CATEGORIES+=("command_injection")
      update_severity "CRITICAL"
    fi
  done
fi

# ============================================================
# PHASE 2.5: Premium patterns check (if installed)
# ============================================================
PREMIUM_CHECK="$SCRIPT_DIR/sentinel-premium-check.sh"
if [[ -x "$PREMIUM_CHECK" ]]; then

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High

• Category: Privilege Escalation

Content

update_severity "HIGH"
  fi

  # Bulk .env patterns (3+ KEY=VALUE on separate lines)
  ENV_COUNT=$(echo "$INPUT" | grep -cP '^[A-Z_]{3,}=\S+' || true)
  if [[ $ENV_COUNT -ge 3 ]]; then
    THREATS+=("secret_leak: Possible .env file contents ($ENV_COUNT key=value pairs)")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.