sanitize — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sanitize (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A local-first, zero-dependency CLI that strips secrets and customer-identifying data out of support notes, logs, and configs, replacing them with stable, typed placeholders instead of a blanket <REDACTED>. Topology and relationships are preserved (the same IP always maps to the same placeholder in a run), so the text stays useful for debugging while the sensitive bits are gone.
10.42.1.15 failed to connect to 10.42.1.16 on port 4647
↓
<PRIVATE_IP_1> failed to connect to <PRIVATE_IP_2> on port 4647Reach for this proactively, before any of the following:
.env),or support-case notes to an external AI model or any service off this machine.
output, agent configs) into a chat, ticket, or PR that leaves the local box.
Also use it on explicit request — e.g. "sanitize this", "redact this log", "is this safe to paste?".
When you are about to include externally-sourced text in a message that leaves the local environment, sanitize it first and use the sanitized version. If you are unsure whether content is safe, run it through strict and show the report.
The sanitizer is bundled inside this skill (pure Python 3.11+, no install). Call the wrapper with an absolute path so it works from any working directory:
python3 "<SKILL_DIR>/run.py" INPUT [options]<SKILL_DIR> is the directory containing this SKILL.md. Sanitized text goes to stdout; reports go to stderr, so redirection stays clean.
Common invocations:
# Sanitize a file to stdout
python3 "<SKILL_DIR>/run.py" alloc.log
# Pipe text in (e.g. content you were about to paste)
printf '%s' "$TEXT" | python3 "<SKILL_DIR>/run.py" --report
# Choose a profile and name the customer to redact
python3 "<SKILL_DIR>/run.py" case-notes.txt --profile case-summary --customer "Acme Corp"
# Write the clean text to a file; report prints to the terminal
python3 "<SKILL_DIR>/run.py" notes.txt --report > clean.txt| Profile | Use when… | Notably preserves |
|---|---|---|
strict | Unsure the content is safe. Redacts the most (incl. URLs, UUIDs, phones). | Ports, timestamps, error text. |
infra-safe (default) | You want infra/debugging context intact. | Timestamps, ports, protocols, status codes, cloud regions, generic service names. |
case-summary | Pasting a case narrative into an AI assistant. | Product names (Nomad, Consul, Vault, Terraform…), versions, the technical narrative. |
For infrastructure debugging (e.g. Nomad/Consul/Vault logs and configs), infra-safe is usually the right default — it keeps the technical signal while removing secrets, IPs, hostnames, and customer identity.
| Flag | Purpose |
|---|---|
-o, --output FILE | Write sanitized text to a file instead of stdout. |
--profile NAME | strict, infra-safe (default), or case-summary. |
--report | Count summary of what was redacted → stderr. |
--json-report | Machine-readable summary → stderr. |
--customer NAME | Literal org/customer name to redact as <ORG_n> (repeatable). |
--allow TERM | Term to never treat as a hostname (repeatable). |
--config FILE | Path to a .sanitizer.yml (else auto-discovered up the tree). |
--no-config | Skip .sanitizer.yml auto-discovery. |
--debug | Include original values in the report (local only; off by default). |
--report, briefly tell the user what was redacted (counts bytype), so they can confirm nothing important was lost or missed.
It can miss novel secret formats and can occasionally over-redact. The user must review the output before sharing it externally.
A .sanitizer.yml in the repo (or up the tree from the input) is auto-loaded. It can add customer_names, an allowlist of non-hostnames, and custom extra_patterns. See examples/sanitizer.yml.example.
The examples/ folder beside this file has realistic before-text to try: nomad-client.log, nomad-scheduler.log, consul-agent.hcl, vault-config.hcl, case-notes.txt. Good for verifying the skill works:
python3 "<SKILL_DIR>/run.py" "<SKILL_DIR>/examples/nomad-client.log" --report~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.