// docs

Skills & Guardrails

Skills are the agent's hands. Approvals and scopes are the leash — you decide exactly what S.E.N.T.R.I can touch.

Built-in skills

Every skill below ships with ServerEngine. Each one is switched on or off individually in Settings, and nothing here is reachable by the agent until you enable it — see Approvals for gating the ones you do. In the chat, hover a skill in the Available Skills panel to see its description and every sub-skill it offers.

Administration

SkillWhat it does
AdminRun a command and read its output straight back. On this machine it runs PowerShell. On a remote host (Commander) a Windows host runs PowerShell over WinRM and a Linux host runs Bash over SSH — the host's own tag decides which, not the agent.
AutomationRead job status and job IDs from the dashboard; restart or cancel a job.
Plan ExecutionCheck the current time, and schedule a runbook for a given host, date and time.
Check AvailabilityPing hosts, or check whether a specific port is open.
Check EventsRead recent Application, System or Security events from a host.
Check LogsPull the most recent ServerEngine log entries.
Active DirectorySearch users and groups, read user info, and list a user's groups or the members of a group or department. Requires RSAT.
Hypervisor ESXiVMware ESXi over SSH: list VMs and snapshots, read VM and host info, power VMs on and off, create VMs, create and remove snapshots, and list datastores and networks.
Hypervisor ProxmoxThe same for Proxmox VE.

Coding, desktop and browser

SkillWhat it does
CoderRead files (whole, or a range of lines), write new files, edit in place, remove, find files by name (glob) and search their contents (grep) — inside the working folder you point it at. That folder is its boundary: paths outside it are refused, and until you pick one every call fails.
Computer UseDrive the Windows apps on this machine: list the open windows, read a window's controls, type, click, press keys, hover and take screenshots.
Browser UseDrive a real browser: open pages, snapshot them for element references, click, fill forms, pick from dropdowns, upload files, work with tabs, read console errors, network traffic and cookies, and save a signed-in session for later.
VisionLook at a pasted image, or compare several at once, and answer from a vision model — so even a text-only chat model can read a screenshot or an error dialog.
ImageGenCreate an image from a prompt, edit an image you pasted, or blend several references into one. The result is saved and handed back, ready to refine.

The browser runs out of sight

The browser S.E.N.T.R.I drives is headless, so nothing appears on your screen. Ask it to show the Playwright dashboard for a live view of the session, where you can watch or take over, or to open a normal visible window instead. It can also reuse your saved logins.

Cloud and DevOps

SkillWhat it does
GitHubCreate and clone repos, commit, push and pull, branches, pull requests, issues, Actions workflows and secrets, releases and code search.
CloudflareDeploy Workers and Pages, work with KV, R2 and D1, zones, DNS and custom domains, purge the cache and read analytics. One call can create a whole app: the GitHub repo, the Pages project and a deploy workflow, so every later push deploys.
StripeProducts and multi-currency prices, payment links, customers, subscriptions and discount codes.
Google Search ConsoleSearch traffic, top queries and pages, sitemaps, and index status for a URL.
Web SearchSearch the web and fetch a page's real content (Brave-powered — bring your own key).

GitHub, Cloudflare, Google Search Console and Stripe are connected per account in Settings before the agent can use them.

Collaboration

SkillWhat it does
Slack MessagePost into the Slack channels you configured, up to three.
SlackPrompt an agent in the Agent Workspace from Slack with @sentri; each channel gets its own agent.
DiscordThe same for Discord: @sentri in a channel prompts that channel's agent.
WhatsAppMessage yourself on WhatsApp to prompt the main agent with text, images or voice notes, and answer approvals by reply.
Jira Ticket ManagerCreate and read tickets and subtasks, transition status, update descriptions, comment, and list your tickets.
Confluence PagesCreate, read and update Confluence pages.

How each chat app is connected, and which agent answers it, is covered in Chat Integrations.

Agent tools

SkillWhat it does
PlanPlan mode: propose a plan and its phases first, then wait for Execute or Keep planning.
TaskThe checklist you watch: phases declared before multistep work starts, and ticked off one at a time.
AskPut a genuine choice to you as a short list of options, each with its trade-off.
MemoryRead, save, correct and remove memories for the current work folder.
User knowledgeLets S.E.N.T.R.I address you by name.

Plan mode, checklists and questions are covered in the Agent Workspace, and memory has its own page: Memory.

How skills run

  • Visible — every call shows in the chat as it runs, with the skill's name highlighted. The raw call itself is hidden from the transcript, and you can watch a script run while the agent executes it.
  • Batched — when the agent already knows what it needs, it sends several calls in one go instead of paying a round trip for each. Calls to Admin, Coder, Computer Use and Browser Use run one after another, in the order written, so a later step can rely on an earlier one.

Custom skills from runbooks

Turn any runbook into a skill S.E.N.T.R.I can call. Give it a description and an optional parameter, and the agent can trigger the whole workflow from a natural-language request. A runbook skill always runs against a host: name one in your prompt, or the agent asks you which.

Approvals

Every skill has an approval-required checkbox in Settings. When the agent wants to run a skill that has it ticked, ServerEngine shows a confirmation card with the exact skill and host, and waits for you to Accept or Decline before anything executes — in the chat, or by reply on WhatsApp. Decline, and the agent is told you refused and moves on.

Those two buttons belong to you alone. Even with the Computer Use skill, which can click almost anything on the screen, the agent cannot press Accept or Decline on an approval card: the skill refuses.

Unattended runs move the approval earlier

A confirmation needs someone to answer it, and a scheduled prompt has nobody there. So an unattended run does not stop to ask — and it does not silently skip the skill either. The approval happens when you write the schedule: its Allowed skills picker decides exactly what that run may call, and nothing outside it is offered. Tick that list as deliberately as you would answer a prompt, and keep the scope tight.

Scopes

A scope is an allow-list of hosts. Build it from your server groups to define exactly which machines S.E.N.T.R.I may act on. The agent is only ever shown the hosts in the current scope and is instructed to use nothing else — so it can't wander outside your boundary. Every agent in the Agent Workspace has a scope of its own, and /scope changes it from the prompt line.

Scopes across your servers are part of Commander (AI Guardrails). On the S.E.N.T.R.I plan the agent works on the machine it runs on: the LOCAL (This Computer) scope.

Limits built into the skills

Some boundaries are not settings at all — the skills are simply built without the risky part:

  • Coder never leaves its working folder. It refuses to edit a file it has not read in the conversation, will not overwrite an existing file unless told to replace it, and its remove is permanent — there is no recycle bin — which makes Coder a good candidate for approval.
  • GitHub creates repositories private unless you ask otherwise, has no way to delete a repository, and its raw API access is read-only.
  • Cloudflare has no way to delete a zone or a Pages project, and deleting a Worker needs an explicit confirmation. It cannot buy a domain either; that stays in the Cloudflare dashboard.
  • Computer Use cannot answer an approval card, as described above.
  • Browser Use is instructed never to buy, send, delete or post anything you did not ask for.
  • ImageGen costs real money per call, so it makes one image per request and never silently retries a prompt that worked.

Layered control

Combine the three: disable skills you don't want available, require approval on the risky ones, and scope the agent to a safe set of hosts. You get autonomy where it helps and a hard stop where it matters.

Admin skill safeguards

The Admin skill grants full PowerShell access to a host. ServerEngine guards against overlapping sessions so two connect requests can't race, and every action still respects your approval and scope settings.