SentinelXPrime

Stage-aware security skills for Codex, Claude Code, and OpenCode, with explicit compatibility guidance for Cursor and Kilo.

AI coding agents accelerate development but rarely surface security concerns at the right moment. SentinelXPrime fills that gap by embedding stage-aware security skills directly into your coding agent workflow — from planning through release.

The suite helps teams catch missing security requirements during planning, surface scoped concerns during risky implementation work, offer opt-in review help after coding, and propose a practical security check plan before release. It is advisory-first: it improves signal and consistency, but it does not certify a repository as secure, fully reviewed, or production-ready.

How It Works

SentinelXPrime maps to four development stages, each with a dedicated skill:

1. Planning — sentinelx-plan-gap: identifies missing security requirements before code is written.
2. Implementation — sentinelx-prime: surfaces scoped security concerns during risky changes.
3. Review — sentinelx-review-gate: provides opt-in security review after implementation.
4. Pre-release — sentinelx-test-rig: proposes a stack-aware security check plan before release or handoff.

Use using-sentinelx as the lightweight bootstrap skill when a session needs quick orientation to the suite.

Supported Stacks

.NET / ASP.NET Core · Java / Spring · Node / TypeScript · Python · Go · Ruby on Rails · PHP / Laravel · Rust

If the stack is unclear, SentinelXPrime falls back to common web-security guidance and notes that the stack inference is uncertain.

For crypto-sensitive discussions, cross-check skills/shared/crypto-guidance.md.

Stage Decision Aid

Installation

Supported means the repository ships a documented install surface that exists in this repo. Compatibility guidance means the repo documents a low-risk way to reuse the instructions and skills without claiming an officially validated plugin path.

Release or handoff claims for supported platforms should be backed by recorded smoke evidence in docs/validation/release-readiness.md. Run node scripts/check-release-readiness.mjs or the Release Claim Readiness workflow before making an external release-ready or handoff claim.

Quick Start

Start a fresh session and try one of these prompts:

Use sentinelx-prime while we plan this new ASP.NET Core feature.

Use sentinelx-plan-gap to review this Node/TypeScript API design for missing security requirements.

Use sentinelx-review-gate to run a focused security review on the completed auth changes.

Use sentinelx-test-rig to propose a stack-aware security check plan for this release handoff.

More examples in docs/examples/example-prompts.md.

What's Inside

Philosophy

SentinelXPrime is built on a clear safety model:

• Advisory-first — guidance by default, never silent enforcement.
• No false assurance — findings state what was checked and what was not.
• No silent installs — nothing is installed or mutated without explicit user action.
• Read-only analysis — active analysis runs only after explicit user consent.
• Transparent outputs — substantial results separate reviewed areas, unreviewed areas, assumptions, and tools run.

Updating

See CHANGELOG.md for notable changes between versions.

Troubleshooting

Validation and Release

Prerequisites

• Node.js 22
• Ruby (for scripts/static-validation.sh)
• codex CLI on PATH (for live eval runs)
• Readable Codex auth at $CODEX_HOME/auth.json or ~/.codex/auth.json (for live eval runs)
• unzip plus either zip or ditto (for release packaging and archive verification)

Local Verification

bash scripts/static-validation.sh
node evals/run-sentinelx-prime.mjs --manifest-json
node evals/run-sentinelx-prime.mjs --preflight-only
node evals/run-sentinelx-prime.mjs
node evals/run-sentinelx-prime.mjs --promote-artifacts
bash tests/hooks/test-session-start.sh
node scripts/check-doc-links.mjs
node scripts/check-legacy-names.mjs

Release Packaging

bash scripts/package-release.sh
SENTINELX_PRIME_FORCE_NO_RSYNC=1 bash scripts/package-release.sh SentinelXPrime-fallback
node scripts/verify-release-archive.mjs dist/SentinelXPrime.zip
node scripts/verify-release-archive.mjs dist/SentinelXPrime-fallback.zip
node scripts/check-release-readiness.mjs

Build release archives only from a clean SentinelXPrime repo root. Do not package from wrapper workspaces, nested source trees, or Finder/manual zips. Treat scripts/package-release.sh as the canonical release archive flow.

Migration

See docs/migration-from-codex-sentinel.md for renamed skills, command changes, archive/env var updates, and breaking changes.

Contributing

Contributions, feedback, and bug reports are welcome. Please open an issue or submit a pull request.

License

MIT. See LICENSE.