360 Secure SkillHub
360 安全技能中心

Engrm Sentinel

该技能在代码进入认证、密钥、输入处理、API 边界、安全敏感数据、重构或部署配置等风险区域时,借助 Engrm packs 与 Sentinel 上下文指出可能出错之处,并给出更安全的做法。仅在 Engrm 已连接时使用,否则声明上下文未连接并继续,不虚构命令或安装步骤。

dr12hes
dr12hes
热度 44.51
最近更新 2026-05-11 17:33:34
分类:安全依赖:内部调用大模型应用场景:代码审查

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add engrm-sentinel
Metadata
name
engrm-sentinel
description
Use Engrm packs and Sentinel context to surface likely mistakes, risky patterns, and lessons that would have prevented them.

Engrm Sentinel

Use this skill when code is entering a risky area and the goal is to prevent mistakes, not just remember past work.

Before you start

Use Engrm only if it is already connected and available in the current environment.

If Engrm is not available, say that Engrm Sentinel context is not connected on this machine and continue without inventing setup steps or shell commands.

Command guardrails

Do not invent Engrm shell commands like engrm search, engrm save, or engrm timeline.

Treat Sentinel guidance as Engrm workflow knowledge, not as an excuse to guess at extra CLI syntax.

What this skill is for

  • Surface risky patterns before they turn into bugs or security issues.
  • Reuse pack knowledge and standards during active coding work.
  • Explain what is going wrong, not just that something looks unusual.
  • Keep prevention practical and grounded in project context.

When to use it

Use this skill when the task involves:

  • authentication or secrets
  • input handling or API boundaries
  • security-sensitive data
  • major refactors
  • deployment or config changes
  • code that has caused repeated issues before

Sentinel mindset

Ask:

  • What could go wrong here?
  • Which pack lessons are relevant?
  • Is this repeating a known mistake?
  • Is the implementation drifting into a risky shortcut?
  • Would a future session benefit from a new standard or lesson here?

Good outputs

Helpful Sentinel guidance should:

  • name the likely mistake clearly
  • explain why it matters
  • connect it to a reusable lesson or pack
  • suggest the safer path

Avoid:

  • generic fearmongering
  • abstract policy language without code relevance
  • blocking everything just because it feels risky

Pack-aware review

Remember:

  • packs are available on free plans too
  • the point is not to hide lessons behind paid access
  • the real value is turning those lessons into smarter review, stronger prevention, and better follow-through

What success looks like

The agent catches meaningful mistakes early, explains them well, and leaves behind a sharper memory or standard for the next session.