Source code security audits, SAST, dependency review. When findings are listed or audit ends, MUST chain to sentinel-report — read skills/sentinel/sentinel-report/SKILL.md, ask save folder, Write .md + offline .html. Triggers on audit, vulnerability, security review, 审计.
Use for CTF (Capture The Flag) challenges — web exploitation, binary pwn, cryptography, reverse engineering, forensics, and misc. Invoke when user mentions "CTF", "flag{", "challenge", "HackTheBox", "TryHackMe", "PicoCTF", "pwn", or shares a challenge description asking how to solve it.
Use when user mentions CVE, CVSS, vulnerability lookup, exploit research, CVE database search, or asks about a specific vulnerability severity and mitigation. Invoke when user shares a CVE ID, asks how to assess vulnerability severity, or needs to find known exploits for a component.
Authorized pentest workflow. When engagement summary or findings are delivered, MUST chain to sentinel-report — read sentinel-report/SKILL.md, ask save folder, Write .md + offline .html.
MANDATORY after sentinel-audit, sentinel-pentest, sentinel-frontend completes. Default write sentinel-security-assessment.md + sentinel-security-assessment.html. MUST ask save folder. HTML has ECharts pie (online, CDN) + CSS-bar fallback (offline). Multi-project tabs show each project vuln count as proportion of total. Triggers on audit complete, report, 报告, HTML deliverable.
Use for engineering discipline around security work — systematic root-cause tracing, verification before claiming success, structured review of fixes, threat-focused design exploration, and coordinating parallel multi-target analysis. Standalone replacement for external workflow plugins. Works in Claude Code, Cursor, Codex, Trae, and similar agents; attach this SKILL.md explicitly when the host does not auto-load skills.
Short-path entry for the Sentinel security skill bundle — route to audit, pentest, CTF, CVE, report, frontend, workflow. Use when user @ this file or says sentinel / 安全审计 / 渗透报告.
Entry for security tasks (audit, pentest, CTF, CVE). After audit/pentest/frontend audit completes, MUST load sentinel-report/SKILL.md and Write .md + .html — never stop at chat-only findings.