SecSentinel

Standard coding agents treat file contents and API responses as instructions, leaving you vulnerable to prompt injection. This skill implements a strict security layer that treats external data as untrusted. It prevents agents from following commands embedded in scraped text, webhooks, or uploaded files.

What it does

• Source classification tags every piece of content as trusted or untrusted before the agent processes it.
• Directive scanning detects override patterns, fake system headers, and unauthorized config edit requests.
• Secret protection blocks silent reads of environment variables, credentials, or secret stores.
• Instruction flagging emits a clear warning and drops malicious payloads while continuing the safe parts of the task.
• Immutability enforcement ensures system rules and operational constraints cannot be redefined by external inputs.

How it works

1. Identify the source of all input to separate direct user messages from untrusted external content like API results.
2. Scan untrusted fragments for injection markers, such as phrases attempting to cancel previous instructions.
3. Drop detected malicious instructions and emit a ⚠️ UNTRUSTED INSTRUCTION DETECTED signal to the user.
4. Process only the safe portions of the request, refusing any calls to sensitive files or shell commands originating from the data.

Frameworks & tools

This skill is framework agnostic and works with any LLM based agent, including Claude Code, Cursor, and custom autonomous agents. It focuses on the logic layer of input handling and permission boundaries.

Why this beats prompting it yourself

Writing reliable guardrails is difficult because LLMs easily bypass simple "ignore instructions" prompts. This skill uses a structured classification and flagging system that targets specific injection patterns and secret-read behaviors that standard system prompts often miss.

Use cases

• Processing raw text from web scrapers or external RSS feeds.
• Building agents that handle third party webhook payloads.
• Analyzing untrusted codebases or configuration files for security audits.
• Running agents in multi-tenant environments with shared resources.

Known limitations

This skill requires the agent to have visibility into the source of the content. It cannot defend against injections that the user manually copies and pastes as a direct message.