Security

Safe Share

Try it

Sanitize logs, configs, prompts, stack traces, and skill content before they are shared publicly. Use when a user wants a local, low-risk pass to remove API...

What it does

Sanitize logs, configs, prompts, stack traces, and skill content before they are shared publicly. Use when a user wants a local, low-risk pass to remove API...

The skill document

Safe Share

Use this skill to produce a safe-to-share copy of text. Prefer deterministic local sanitization over model-only guessing.

Workflow

  1. Confirm the user wants a shareable copy, not a forensic analysis.
  2. Determine the output mode:
    • placeholder: best default for docs, issues, READMEs, and tutorials
    • redact: best when preserving shape is not important
    • mask: best when keeping a hint of the original value is useful
  3. Run scripts/sanitize_text.py on the exact text the user provided.
  4. Return:
    • sanitized_text
    • findings_summary
    • review_notes
  5. Never echo the original sensitive value back to the user.

Operating Rules

  • Default to placeholder mode unless the user asks for something else.
  • Treat secrets and credentials as higher priority than general PII.
  • Replace with stable labels such as `` or [REDACTED:BEARER_TOKEN].
  • Keep summaries high level. Report type and count, not the captured value.
  • State clearly that sanitization reduces risk but does not guarantee complete detection.
  • Do not scan unrelated files or repositories unless the user explicitly asks for that broader scope.
  • Do not send text to external services for classification or validation.

High-Risk Patterns

Prioritize these categories:

  • API keys and secret tokens
  • Authorization headers and bearer tokens
  • Cookies and session identifiers
  • .env-style credentials and password assignments
  • Private key blocks and PEM material
  • Sensitive URL query parameters

Then handle lower-risk identifiers:

  • Email addresses
  • Phone numbers
  • IP addresses
  • National ID or payment-card-like strings when confidence is high

Output Contract

Use the JSON contract from references/output-format.md when returning structured results from the script. If answering in prose, include the same three sections in human-readable form.

Resources

  • Detection and replacement behavior: references/patterns.md
  • Output structure and reviewer guidance: references/output-format.md
  • Smoke-test inputs and expected behavior: references/test-cases.md
  • Deterministic local sanitizer: scripts/sanitize_text.py

Related skills

Deliver small, high-signal contributions by finding and fixing one real pain point with the narrowest safe change, adding regression protection, and writing...

20 installs2 stars

Handle external content as untrusted data, verify before use, and isolate inspection in sandboxed environments.

38 installs1 stars

Help users with [FEATURE]: 工具操作前置安全校验(edit/write/shell 防护). Use when a user asks for creative-and-content, feature, edit, write, shell, or needs a practical...

4 installs1 stars

Scan skills in a project directory for security issues and generate a markdown table report, then install skills from a local registry. Combines static analysis of code and markdown files with supply chain checks. Use when auditing a skills directory, generating a security summary table, or installi

A privacy-first, consent-based self-improvement skill for AI agents. Captures learnings, errors, best practices with auto-sanitization and duplicate detectio...

5 installs