Sentry skill-scanner — agentic threat model

Not certain from the listing — likely relies on a general-purpose LLM to evaluate prompt-injection risks and suspicious instructions, making it vulnerable to adversarial bypasses or indirect prompt injection from the very files it scans.

The agent reads skill directories, SKILL.md, and bundled scripts. The primary threat is data exfiltration of sensitive configurations or intellectual property within those directories, or poisoning of the scanner's context via malicious files.

The agent orchestrates a review workflow over directories. Vulnerabilities include insecure tool integration (file system readers) and potential path traversal if the directory path inputs are not sanitized.

Not certain from the listing — the hosting environment and sandboxing of the script-evaluation process are unspecified. If the scanner executes or parses scripts without a secure sandbox, it could lead to local code execution.

Not certain from the listing — there is no mention of how the scanner's own decisions are logged, audited, or protected against evaluation gaming (e.g., a malicious skill hiding its true intent).

Not certain from the listing — lacks details on authorization controls restricting which directories the scanner can access, or compliance audits for the tool itself.

Directly interacts with the ecosystem by scanning other installed skills. Threats include A2A trust abuse, where a malicious skill exploits the scanner's read access, or the scanner itself being used as a vector to map out vulnerabilities across the agent ecosystem.