Sensitive Data Sanitizer

Stop leaking secrets in logs and code snippets. Sharing raw debugging data with AI assistants, vendors, or public tickets often leads to accidental exposure of credentials and PII. This skill provides a systematic way to identify, mask, and report sensitive data without compromising the utility of the file.

What it does

• Multi-category detection finds credentials, API keys, emails, IP addresses, and financial identifiers across text-based files.
• Consistent masking replaces sensitive values with stable placeholders like <EMAIL_1>, ensuring relationships remain visible for debugging.
• Local-first processing uses a bundled Python script to sanitize files on your machine before they are ever read by the LLM.
• Structural preservation keeps key names, punctuation, and line counts intact so sanitized files remain parsable and valid.
• Safety reporting generates a summary of findings by category and line number without ever repeating the redacted values.

How it works

1. Identify the source and the destination (e.g., public repo, internal ticket, or AI chat) to set the strictness level.
2. Execute the sanitizer script against a file or directory to create a separate .sanitized version.
3. Review the findings report to verify masked counts and identify any high-entropy strings flagged for manual review.
4. Perform a contextual pass to catch names, addresses, or project codenames that pattern matching might miss.

Frameworks & tools

Uses a Python 3.8+ script with standard library dependencies. Works with logs, source code, CSVs, and configuration files.

Why this beats prompting it yourself

Generic "redact this" prompts often hallucinate new data, miss edge cases like high-entropy strings, or accidentally repeat the secret in the summary. This skill enforces a "never read before redacting" workflow and uses stable, numbered placeholders that maintain technical context for troubleshooting.

Use cases

• Log sanitization for sharing production errors with external support vendors.
• Config scrubbing before committing templates or example files to public repositories.
• PII removal from CSV exports or database dumps before data analysis.
• Safe AI prompting to ensure keys and tokens are stripped before pasting code into a chat interface.

Known limitations

Supports text-based files only. Cannot sanitize images, PDFs, office documents, or archives. Does not detect IPv6 or short-format phone numbers. Manual review is required for names and free-form text.