Sentinel
GitHub Download EXE
Sentinel – Indirect Prompt Injection Defense

Protect Your AI from Hidden Instructions.

Sentinel helps identify indirect prompt injection attacks, assess security risks, and sanitize suspicious content before it reaches your AI workflow.

Download for Windows Explore on GitHub
Sentinel Security Operations Center — http://127.0.0.1:8501
Security operations center · Overview

Sentinel Security Dashboard

Sentinel – Indirect Prompt Injection Defense. Monitor locally analyzed content, review recent detections, and inspect untrusted text before it enters an AI workflow.

Total Scans
10
High-Risk Detections
4
Medium-Risk Detections
4
Safe Inputs
2
Scanned at (UTC) Risk Score Findings Action
2026-10-23T11:43:46 Critical 80 / 100 6 signals QUARANTINE
2026-10-23T11:45:42 Medium 30 / 100 1 signal SANITIZE
2026-10-23T11:46:10 Medium 30 / 100 1 signal SANITIZE
2026-10-23T11:46:44 Low 0 / 100 0 signals ALLOW
About The Project

Understanding Indirect Prompt Injection

As Large Language Models become integrated into real-world business pipelines, the boundary between trusted instructions and untrusted data becomes the primary attack surface.

What is Indirect Prompt Injection?

Direct prompt injection occurs when a user enters adversarial instructions directly into a chatbox. In contrast, indirect prompt injection (IPI) happens when an adversary places malicious directives inside third-party content—such as an email, support ticket, resume, web article, or database record—that an AI system is asked to read or summarize.

Why is It Dangerous?

When an LLM processes untrusted external content, it cannot inherently distinguish between the application developer's system instructions and directives contained inside the text. Adversaries can trick models into overriding safety guardrails, exfiltrating confidential conversation context, or executing unauthorized actions through integrated tool calls.

How Sentinel Defends Your Systems

Sentinel acts as an inspection gateway before untrusted content enters your AI context. It applies explicit pattern-matching heuristics, calculates multi-category risk scores, removes suspicious lines through conservative sanitization, and verifies model outputs against credential leaks—all executed 100% locally on your computer.

Core Capabilities

Built-In Security Features

Sentinel provides a complete suite of defensive tools designed specifically to inspect, assess, and manage indirect prompt injection risks.

1. Indirect Prompt Injection Detection

Explicit regular expressions and Unicode analyzers detect instruction overrides, attempts to discard safety guardrails, privileged role assumption, and covert tool misuse commands.

2. Security Risk Assessment

Computes transparent risk scores from 0 to 100 across five configured categories, mapping findings into clear severity levels: Low (0–19), Medium (20–44), High (45–69), and Critical (70–100).

3. Suspicious Content Sanitization

Removes detected adversarial instruction lines automatically, producing a sanitized text preview for analyst review while preserving surrounding benign content whenever possible.

4. AI Output Verification

A standalone defense guard that checks proposed AI completions for credential-like values, private cryptographic keys, and attempts to disclose hidden developer system prompts.

5. Scan History

Audit log with search filters, severity filtering, and CSV export capabilities. Evaluated content is kept private—only metadata and category findings persist in records.

6. Security Analytics

Aggregated visual telemetry that monitors safe versus suspicious distribution, risk level breakdowns, and the most frequent attack patterns observed over time.

7. Threat Intelligence Samples

Curated library of realistic test samples—including override payloads, exfiltration attacks, hidden HTML comments, zero-width obfuscation, and safe cybersecurity texts.

8. Local SQLite Database

Embedded, zero-configuration SQLite persistence engine (sentinel_history.db) that stores audit logs locally without external database servers or cloud transmission.

Security Workflow

How Sentinel Inspects Content

A transparent, six-step detection and sanitization pipeline operating strictly within your local machine.

Step 1

Upload or Paste Content

Pasted text or text documents (UTF-8 .txt, .md, .eml, .csv, .html, .json, .xml) are ingested up to 5 MB. Files are decoded strictly as text and never executed.

Step 2

Sentinel Analyzes Text

The rule-based detection engine in ipi_guard.py scans the input using regular expressions and Unicode checks without sending any data to external APIs.

Step 3

Signals Are Identified

Heuristic patterns flag instruction overrides, credential harvesting, confidential file exfiltration, unauthorized tool calls, concealment, and obfuscated tokens.

Step 4

Risk Scoring & Severity

Highest weights per category are summed up to a maximum score of 100, assigning a severity band (Low, Medium, High, or Critical) and recommended defense action.

Step 5

Sanitization or Quarantine

Suspicious lines are stripped to produce a sanitized text preview. High and Critical severity content is designated for quarantine by the default security policy.

Step 6

Inspect & Export Report

Security analysts inspect evidence excerpts, review findings, export CSV audit records, and run proposed AI outputs through the AI Output Guard before release.

Important Security Principle: Sanitization is an assistive mitigation technique, not a cryptographic guarantee of safety. High-risk and Critical-risk content should remain quarantined and manually reviewed by security personnel.
Why Sentinel

Key Security Benefits

Designed specifically for cybersecurity engineers, AI developers, and security researchers seeking transparent prompt defense.

Identify Hidden Instructions

Uncovers covert adversarial directives concealed inside external customer tickets, scraped web data, and uploaded documents before they reach an LLM.

Transparent Heuristic Risk Scores

Calculates clear, explainable scores (0–100) based on observable detection categories rather than opaque, uninterpretable black-box model predictions.

Inspect Potentially Malicious Text Safely

Analyze raw attack payloads safely in an isolated text-decoding environment without running scripts or triggering secondary code execution.

Support Safer AI Pipelines

Serves as a practical pre-ingestion check and post-generation credential guard for AI workflows, agentic tool-use loops, and retrieval-augmented systems.

Local Processing & Zero Data Retention

Keeps analysis completely local on your workstation. No user documents or sensitive payload evidence excerpts are retained in the database or sent across the internet.

Ideal for Students & Researchers

Provides a clean, approachable desktop dashboard for cybersecurity learners, AI safety students, and red-team researchers studying prompt injection techniques.

Note: Sentinel is a prototype security assistant and educational defense tool, not a complete replacement for comprehensive enterprise security boundaries.
Interactive Demo

Test Prompt Injection Detection in Browser

Experience Sentinel's detection rules right here. Choose an attack preset or paste custom text to evaluate how Sentinel identifies threats and calculates risk scores.

Executable Distribution

Download Sentinel for Windows

Get the standalone Windows executable. No separate Python installation required.

Sentinel Desktop for Windows

Standalone Windows executable with self-contained runtime and local dashboard services.

Windows application is currently being prepared. Please check back soon.
Platform & Architecture
Windows 10 / 11 (64-bit)
Version
v1.0.0
File Size
92.95 MB (EXE)
Release Date
October 2026
Verified SHA-256 Checksum (Sentinel.exe):
C417408C0EDA8EB0C3FC8FF7C3DF4BCC384BAC06DE34CED4BFB58D8F1D0241E1

System Requirements:

  • Windows 10 or Windows 11 (64-bit x86_64)
  • 4 GB RAM minimum (8 GB recommended)
  • 200 MB free hard drive space
  • Standard modern web browser (Edge, Chrome, Firefox)
  • No external Python installation needed

Alternative: Source Code Install

Prefer running Python directly? Clone the repository and run in a virtual environment: 

git clone https://github.com/vishnu986676-ux/Sentinel--IPI-Defence
pip install -r requirements.txt
streamlit run add.py
Step-by-Step

Installation & Verification Guide

Follow these simple steps to verify, launch, and run Sentinel on your Windows PC.

  1. Download Sentinel.exe

    Download the Windows executable package from the download section or the GitHub Releases page. Save it to your preferred folder (such as Desktop or Downloads).

  2. Verify File Integrity (SHA-256)

    Open Windows PowerShell in the folder containing Sentinel.exe and calculate its checksum to ensure it hasn't been modified:
    Get-FileHash .\Sentinel.exe -Algorithm SHA256
    Verify that the output matches 6F8C97C7E6B127E99F3BBD3F5AD6F4CA20097BC989618610C172C2F591FDB662.

  3. Understand Windows SmartScreen Prompts

    Because Sentinel is an open-source security prototype without an expensive commercial code-signing certificate, Windows SmartScreen may show an "Unknown Publisher" advisory.

    What to do: After verifying the SHA-256 hash matches this repository, click "More info" and then select "Run anyway". Never disable your antivirus or security software.

  4. Launch Sentinel Application

    Double-click Sentinel.exe. A console window will initialize the embedded SQLite database and launch the local Streamlit application service on http://127.0.0.1:8501.

  5. Interact via Your Default Browser

    Sentinel automatically opens the Security Dashboard in your default web browser. If it doesn't open automatically, simply navigate to http://127.0.0.1:8501.

  6. Clean Shutdown

    When you are finished testing, simply press Ctrl + C in the Sentinel console window or close the console. Background services will terminate cleanly.

Documentation

Application Usage Guide

Explore how to navigate and use each dedicated section of the Sentinel application.

Security Dashboard (add.py)

The landing page displays aggregated security operations metrics: Total Scans, High-Risk Detections, Medium-Risk Detections, and Safe Inputs.

  • Live Metrics: Real-time overview of all scanned items recorded in sentinel_history.db.
  • Recent Activity: Tabular view showing recent scan events, UTC timestamps, calculated scores, and recommended actions.
  • Quick Actions: One-click navigation to the analyzer and visual reference for standard risk bands.

Analyze Content (1_Analyze_Content.py)

The core inspection engine for evaluating untrusted external text before placing it into an LLM context.

  • Input Modes: Paste text directly into the text area or upload documents (UTF-8 .txt, .md, .eml, .csv, .html, .json, .xml) up to 5 MB.
  • Load Example Attack: Quickly populate the analyzer with a representative indirect prompt injection attack for testing.
  • Findings Drill-Down: Expand each flagged signal to inspect the matched category, weight, and excerpted evidence string.
  • Sanitized Content: Review the sanitized preview with stripped suspicious lines.

Threat Intelligence (2_Threat_Intelligence.py)

A curated local test suite of categorized attack vectors and benign control samples.

  • Instruction Override: Demonstrations of emails attempting to override system instructions.
  • Secret Exfiltration: Payloads requesting developer prompts, passwords, or external webhook uploads.
  • Concealment & Obfuscation: Hidden payloads using HTML comments and zero-width spaces.
  • Benign Controls: Legitimate cybersecurity discussions demonstrating the engine's precision against false positives.

Scan History (3_Scan_History.py)

Searchable, filterable audit log of historical scan events stored in the SQLite database.

  • Severity Filter: Filter logs by Low, Medium, High, or Critical risk.
  • Keyword Search: Search by finding label or attack category.
  • CSV Export: Download comprehensive scan records as a CSV file for compliance audits.
  • Privacy Design: Original source text and confidential content are intentionally excluded from logs.

Security Analytics (4_Security_Analytics.py)

Visual telemetry charts generated dynamically from your local scan records.

  • Safe vs. Suspicious: Compare proportion of clean inputs against flagged content.
  • Risk Level Distribution: Breakdown across Low, Medium, High, and Critical bands.
  • Prevalent Attack Categories: Identifies which injection categories (e.g. override, secret exfiltration) are most frequent.

AI Output Guard (5_AI_Output_Guard.py)

Secondary defense barrier inspecting proposed AI model completions before they reach the user or external systems.

  • Credential Leakage: Intercepts API keys, passwords, and access tokens in model output.
  • Cryptographic Keys: Detects private key headers (-----BEGIN RSA PRIVATE KEY-----).
  • Prompt Disclosure: Flags output claiming to quote or reveal the hidden developer prompt verbatim.
Got Questions?

Frequently Asked Questions

Direct, accurate answers based on the Sentinel repository and implementation.

Sentinel is a self-contained cybersecurity tool designed to inspect untrusted external text before it is introduced into a Large Language Model (LLM) context. It detects indirect prompt injection patterns, calculates a heuristic risk score, sanitizes flagged lines, and checks proposed AI outputs for credential disclosures.
Indirect prompt injection occurs when malicious instructions are embedded within third-party data that an AI processes (such as emails, PDF documents, support tickets, or web pages). When the model reads this data, the embedded instructions hijack the model's logic to override developer guardrails or exfiltrate sensitive data.
Yes. Sentinel is 100% free and open-source software hosted publicly on GitHub. You can review the complete source code, audit the regular expression rules, run unit tests, and build it yourself.
No! The packaged Windows executable (Sentinel.exe) bundles its own self-contained runtime environment. You do not need to install Python, pip, or any virtual environment to run the executable.
No. Sentinel operates completely offline on your local loopback address (127.0.0.1). It does not send any telemetry, analytics, or analyzed document text across the internet.
Scan records are stored locally in an embedded SQLite database named sentinel_history.db located in the application directory.
No. By deliberate security design, original content and sensitive evidence excerpts are never saved to SQLite. Only scan metadata (timestamps, numerical scores, severity levels, and category labels) are persisted. Uploaded files are decoded in-memory and never written to disk or executed.
You can explore the source code, open issues, or submit pull requests directly on GitHub at github.com/vishnu986676-ux/Sentinel--IPI-Defence.
Sentinel is an assistive security prototype and educational defense tool. It utilizes explicit pattern heuristics rather than fine-tuned neural classifier models. It should be used as part of a defense-in-depth architecture alongside least-privilege tool access, strict context separation, and human oversight.