Security Sanitizer

Scans and redacts PII / sensitive data from files in this repo. Uses only Python standard library — no external dependencies.

Tools

Resolve scripts project-first, then global install (findings-ledger references/install-paths.md — same pattern, swap skill name):

PROJ="${CLAUDE_PROJECT_DIR:-.}"
SAN="$PROJ/.claude/skills/security/scripts/sanitizer.py"
[ -f "$SAN" ] || SAN="$PROJ/.agents/skills/security/scripts/sanitizer.py"
[ -f "$SAN" ] || SAN="$HOME/.claude/skills/security/scripts/sanitizer.py"
[ -f "$SAN" ] || SAN="$HOME/.agents/skills/security/scripts/sanitizer.py"

Script	Purpose	Key Command
scripts/sanitizer.py	Scan or redact PII in files	python3 "$SAN" --scan --dir . --recursive
scripts/pre-commit-hook.sh	Git hook to block commits with PII	Copy it from the resolved skill directory to .git/hooks/pre-commit, then chmod +x it
scripts/security-scan.sh	Runs the installed deterministic scanners (gitleaks, semgrep, dependency audit) over changed files and reports reproducible evidence. Used by security-reviewer.	bash "$(dirname "$SAN")/security-scan.sh" --base origin/main --json, from the project root. Exits 0 clean, 1 findings, 2 usage, 3 nothing checked, 4 error.
scripts/security-scan-semgrep.yml	Local offline semgrep ruleset, used when SECURITY_SCAN_OFFLINE=1	See scanner-evidence.md

Configuration

Edit scripts/sanitizer-config.json beside this skill (same directory as $SAN) to customize blocklists, custom regex patterns, skip paths, and placeholder format.

Exit Codes

0 = clean, 1 = PII found (useful for CI).

Related skills

• security-engineering — application security, OWASP, auth hardening, input validation, auth/session patterns for web applications