Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsHAR & Log Redactor: Mask Tokens and PII Before You Share
That file holds your live session cookie, a bearer token, API keys in query strings and customer emails in response bodies.
$6.99
HAR & Log Redactor: Mask Tokens and PII Before You Share
Example session with this skill installed
Vendor support wants a HAR of the failing checkout. Redact this capture so I can attach it to the ticket, keep the hostnames, and tell me what you removed.
- Read your context and instructions
- Compiled the har & log
Redacted copy: checkout.redacted.har, 3 entries, hostnames kept.
Mapping file: checkout.map.json. It holds the original values, so it stays on this machine. Don't attach or commit it.
27 replacements of 13 unique values:
| Category | Count | Where |
|---|---|---|
| 7 | login request body, three response bodies | |
| TOKEN | 6 | X-CSRF-Token header, csrf cookie, refresh_token |
| COOKIE | 4 | session in Set-Cookie, Cookie and both cookies arrays |
| IP | 4 | serverIPAddress on all 3 entries, client_ip in the cart response |
| JWT | 2 | Authorization: Bearer, access_token in the login response |
| KEY | 2 | api_key in request.url and queryString |
| PHONE | 1 | login response body |
| SECRET | 1 | password in the login request body |
<<JWT_1>>: alg HS256, claimsiss,expand one namespaced claim. No claim values are recorded.- The cart response was base64 encoded. It was decoded, redacted and encoded again.
- Sizes and timings are left as captured.
Verify: exit 0, no known pattern found (85 strings checked). That means no detector matched. It isn't proof that nothing sensitive remains.
Before you send it: import the copy into your browser's network panel and skim it. The raw capture held a session cookie, a bearer JWT, a refresh token and an API key. If that raw file already went anywhere and any of them still work, rotate them.
Connects securely to your tools. The creator never sees your data.
About this skill
Support asks for a HAR of the failing request. That file holds your live session cookie, a bearer token, API keys in query strings and customer emails in response bodies. Hand-editing a 40 MB JSON file breaks it, and uploading it to a web sanitizer is the exposure you were trying to avoid.
What your agent does
- Works on the path, not the content: it never reads the raw file or the mapping file into the conversation. It reports placeholders, categories and locations only.
- Asks where the copy is going: vendor ticket, public issue or AI chat, then picks options such as
--keep-hosts,--drop-bodiesand--no-map. - Runs one local script:
sanitize.pyrewrites a HAR, JSON file or text log with placeholders such as<<TOKEN_1>>. One value gets one placeholder across the run, and a HAR keeps its entry count. - Replaces by name, shape and entropy: auth headers, cookie values, JWTs, vendor key prefixes, passwords, connection strings, emails, phone numbers in international form, IP addresses and card numbers that pass the Luhn check.
- Verifies the copy: a second pass reruns every detector and exits 3 if anything is left, printing category and location, never the value.
- Reads you the summary: counts per category and location, the key, header and cookie names that triggered, and JWT algorithm and claim names.
Built-in guard rails
- The original file is never modified. The script refuses an output path equal to the input.
- No network code and no subprocesses, Python standard library only.
- The mapping file (placeholder to original value) opens with a warning, and
--no-mapskips it. - The agent says "no known pattern found", never "safe". Binary bodies and data URIs aren't scanned, and the run says so.
What's inside
SKILL.md: eight-step workflow, 10 hard rules, limits.scripts/sanitize.py: the redactor and the verify pass.- 5 reference files: detectors, HAR structure, custom patterns, mapping file handling, sharing checklist.
- 3 fixtures:
checkout.har(3 entries),app.log(20 lines),patterns.example.json. - 272 unit tests in 6 test files.
Detection is by name, shape and entropy. A secret with none of those isn't found, so the last look is yours.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.
Detection is by name, shape and entropy, so a secret with none of those is missed. Personal names and postal addresses need a custom pattern. A GraphQL variable named p or pw is missed. Binary bodies aren't scanned. Phone numbers need a leading plus sign. A clean verify isn't proof.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed today
- Accounts
2
- Software
Python 3 (3 point 8 or later)
A HAR, JSON captureortext logClaude CodeorCodexorCursor- Optional
- A browser to import the redacted HARPatterns file with your own rules
Patterns file with your own names and regexes. Patterns file with your own names and regexes.
Permissions
Allowed Hosts