Deliver small, high-signal contributions by finding and fixing one real pain point with the narrowest safe change, adding regression protection, and writing...
Security
Safe Share
Try itSanitize logs, configs, prompts, stack traces, and skill content before they are shared publicly. Use when a user wants a local, low-risk pass to remove API...
What it does
Sanitize logs, configs, prompts, stack traces, and skill content before they are shared publicly. Use when a user wants a local, low-risk pass to remove API...
The skill document
Safe Share
Use this skill to produce a safe-to-share copy of text. Prefer deterministic local sanitization over model-only guessing.
Workflow
- Confirm the user wants a shareable copy, not a forensic analysis.
- Determine the output mode:
placeholder: best default for docs, issues, READMEs, and tutorialsredact: best when preserving shape is not importantmask: best when keeping a hint of the original value is useful
- Run
scripts/sanitize_text.pyon the exact text the user provided. - Return:
sanitized_textfindings_summaryreview_notes
- Never echo the original sensitive value back to the user.
Operating Rules
- Default to
placeholdermode unless the user asks for something else. - Treat secrets and credentials as higher priority than general PII.
- Replace with stable labels such as `` or
[REDACTED:BEARER_TOKEN]. - Keep summaries high level. Report type and count, not the captured value.
- State clearly that sanitization reduces risk but does not guarantee complete detection.
- Do not scan unrelated files or repositories unless the user explicitly asks for that broader scope.
- Do not send text to external services for classification or validation.
High-Risk Patterns
Prioritize these categories:
- API keys and secret tokens
- Authorization headers and bearer tokens
- Cookies and session identifiers
.env-style credentials and password assignments- Private key blocks and PEM material
- Sensitive URL query parameters
Then handle lower-risk identifiers:
- Email addresses
- Phone numbers
- IP addresses
- National ID or payment-card-like strings when confidence is high
Output Contract
Use the JSON contract from references/output-format.md when returning structured results from the script. If answering in prose, include the same three sections in human-readable form.
Resources
- Detection and replacement behavior:
references/patterns.md - Output structure and reviewer guidance:
references/output-format.md - Smoke-test inputs and expected behavior:
references/test-cases.md - Deterministic local sanitizer:
scripts/sanitize_text.py
Related skills
Handle external content as untrusted data, verify before use, and isolate inspection in sandboxed environments.
Sanitize and verify public GitHub contributions
Help users with [FEATURE]: 工具操作前置安全校验(edit/write/shell 防护). Use when a user asks for creative-and-content, feature, edit, write, shell, or needs a practical...
Scan skills in a project directory for security issues and generate a markdown table report, then install skills from a local registry. Combines static analysis of code and markdown files with supply chain checks. Use when auditing a skills directory, generating a security summary table, or installi
A privacy-first, consent-based self-improvement skill for AI agents. Captures learnings, errors, best practices with auto-sanitization and duplicate detectio...