sentinel-guard
# Sentinel Guard
Choose how to use this skill
You do not need every option. Choose the path your AI client supports. The stable page stays the same; versioned files are immutable.
1. Native installer
This listing has no registered native installer command. Use the complete package or source fallback below, depending on what your client supports.
Do not guess an installer command or replace an existing version without reviewing the diff.
2. Complete package recommended
Download the ZIP when available. It includes SKILL.md plus the references, security notes and version metadata.
No complete ProSkills package is published for this listing yet.3. Prompt-only
Copy the prompt above when the agent can read the stable page or when you want to adopt the workflow without installing a skill.
Need only the instruction file?
Download SKILL.md only if your client requires a single file. The complete ZIP is safer for a full installation because it preserves the references and release context.
No path installs or executes anything by itself. Your agent still needs access to the project files. Before updating, compare the installed version and review the diff.
// RATINGS
Not yet listed on ClawHub or SkillsMP
// README
Sentinel Guard
Lightweight file access monitor that protects sensitive files from AI coding agents.
Watches for .env, API keys, SSH keys, crypto wallets, and other secrets being accessed by tools like OpenClaw, Cursor, or Copilot. Logs everything, alerts in real-time, and can block access via agent hooks.
Install
cargo install --path .
Or download the binary from Releases.
Commands
Setup
sentinel init # Generate config file
sentinel check # Verify installation
Scanning
sentinel scan . # Find sensitive files
sentinel scan . --deep # + check file contents for secrets
sentinel skill-scan . # Scan AI agent skills for malicious patterns
sentinel skill-scan --file X.md # Scan a specific skill file
Monitoring
sentinel watch . # Real-time file access monitoring
sentinel hook # Run as AI agent PreToolUse hook (stdin/stdout JSON)
Integrity
sentinel baseline . # Hash sensitive files
sentinel verify . # Check for changes since baseline
Reporting
sentinel log # View activity log
sentinel log --sensitive # Sensitive events only
sentinel stats # Event statistics
sentinel dashboard # Interactive TUI dashboard
sentinel report . -o report.csv # Export to CSV
sentinel report . -t log -o x.csv # Export activity log
Maintenance
sentinel cleanup --days 7 # Remove old log entries
Config
Generate with sentinel init, customize sentinel.toml:
[watch]
paths = ["."]
recursive = true
[protect]
sensitive_patterns = ["**/.env", "**/*.pem", "**/id_rsa", "**/wallet.dat"]
[alert]
mode = "all" # "log", "terminal", "all"
action = "warn" # "warn" or "block"
desktop_notifications = false
[log]
db_path = "~/.sentinel-guard/activity.db"
retention_days = 30
# Optional webhooks
[[webhooks.endpoints]]
name = "slack"
url = "https://hooks.slack.com/services/..."
format = "slack" # "slack", "discord", "generic"
enabled = false
What It Detects
Files: .env, SSH keys, certificates, AWS/GCloud configs, crypto wallets, OpenClaw secrets, package manager configs
Secrets in code: API keys (AWS, OpenAI, Anthropic, GitHub, GitLab, Slack, Stripe), private keys, database URLs, crypto wallet keys, seed phrases
Malicious AI skills: Data exfiltration commands, RCE patterns, credential harvesting, persistence mechanisms, browser data access
Architecture
src/
├── core/ Config, database, shared types
├── detect/ Secret scanner, skill scanner, integrity checker
├── monitor/ File watcher, rules engine, agent hooks
├── output/ Alerts, dashboard, notifications, webhooks, reports
└── main.rs CLI commands
License
MIT