SentrySkills - Always-On Security Guard

SentrySkills is designed to run AUTOMATICALLY on every task. It provides three-stage protection (preflight → runtime → output) with predictive risk analysis.

⚠️ Installation ≠ Automatic Activation

After installing SentrySkills, you must configure your AGENTS.md to make it run automatically. See install/firsttime_setup.md for details.

How It Works

On every task, SentrySkills:

1. 1. Preflight - Analyzes user intent and planned actions
2. Runtime - Monitors behavior during execution
3. Output - Redacts sensitive data before response
4. Predictive - Warns about potential risks

Quick Enable (One Command)

Add this to your ~/.codex/AGENTS.md:

CODEBLOCK0

Restart Codex and you're protected!

When to Use SentrySkills

Use SentrySkills when you need AI agents to operate safely with:

• - Sensitive data access - Agents reading credentials, secrets, or private information
• System modifications - Agents executing commands, writing files, or changing configurations
• External communications - Agents making network requests or calling external APIs
• Code generation - Agents producing code that might contain vulnerabilities
• Production environments - Any scenario where security cannot be compromised
• Multi-turn conversations - Detect subtle manipulation across multiple interactions

Examples:
CODEBLOCK1

Skill Package Structure

This is a skill package that orchestrates multiple sub-skills:

1. 1. using-sentryskills - User-facing entry point
2. sentryskills-orchestrator - Central coordination
3. sentryskills-preflight - Pre-execution checks
4. sentryskills-runtime - Runtime monitoring
5. sentryskills-output - Output validation & redaction

Each sub-skill has its own SKILL.md with specific requirements.

Execution Requirements

1. 1. Run guard checks before each external output
2. Process sequence: INLINECODE2
3. Block: Prohibit original response, must refuse or redact
4. Downgrade: Must downgrade expression and declare uncertainty
5. Explanatory responses must also go through output guard

Recommended Usage

Default (turn_dir layout)

CODEBLOCK2

With summary output

CODEBLOCK3

Legacy event stream

CODEBLOCK4

Mandatory Logging Protocol

1. 1. Text-only judgment is prohibited - Runtime hook must execute each round
2. Input JSON must include project_path (absolute path to avoid drift)
3. Final response must provide:

1. 4. If script execution fails, declare "security self-check not completed" and adopt conservative output strategy

Default Log Layout

Log root: INLINECODE7

Per-turn directories:

• - INLINECODE8
• INLINECODE9

Global index:

• - INLINECODE10

Session state:

• - INLINECODE11

Policy Profiles

• - balanced: Standard security (default)
• strict: Maximum security
• permissive: Minimal interference

Detection Coverage

Preflight Stage

• - Prompt injection patterns
• Malicious intent detection
• Sensitive topic inference
• Action classification

Runtime Stage

• - Event monitoring
• Source tracking
• Anomaly detection
• Behavioral analysis

Output Stage

• - Sensitive data redaction
• Source disclosure handling
• Confidence assessment
• Safe response generation

Predictive Analysis

• - Resource exhaustion prediction
• Scope creep detection
• Privilege escalation warning
• Data exfiltration path analysis
• Multi-turn grooming detection

Integration

As Codex Skill

Copy to skills/sentryskills/ and reference in agent configuration.

Configuration Files

• - shared/references/runtime_policy.*.json - Security policy profiles
• INLINECODE14 - Detection rule definitions
• INLINECODE15 - Input validation schema

Testing

CODEBLOCK5

Event Types

The system emits structured events for:

• - preflight_result - Pre-execution check outcome
• INLINECODE17 - Runtime monitoring outcome
• INLINECODE18 - Output validation outcome
• INLINECODE19 - Risk prediction (if enabled)
• INLINECODE20 - Overall decision with rationale
• INLINECODE21 - Completion with duration

Each event includes:

• - Trace ID for correlation
• Decision (block/downgrade/allow/continue)
• Reason codes
• Matched rules
• Metadata

Performance

• - Typical latency: 50-100ms per check
• Memory: <50MB baseline
• Zero external dependencies (Python stdlib only)

Security Properties

• - No data exfiltration: All processing is local
• No LLM calls: Pure rule-based and heuristic
• Audit trail: Complete event log for compliance
• Transparent: All decisions include reason codes