Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local text sanitizer that is clearly scoped to replacing secrets and sensitive identifiers before sharing.
Install this skill only for local sanitization workflows. It is designed to reduce accidental sharing of secrets, but users should still manually review output because deterministic rules can miss custom identifiers, names, addresses, or context-specific sensitive data.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Input:
Set OPENAI_API_KEY=sk-examplesecret123456789 in your .env file.
Then call https://api.example.com/build?token=raw-demo-token&id=42
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
for rule in RULES:
def _replacer(match: Match[str], rule: Rule = rule) -> str:
counts[rule.name] += 1
return rule.replacer(match, mode)
text = rule.pattern.sub(_replacer, text)
The skill instructs use of a local script and references additional files, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch can cause the agent runtime to infer broader file-read or network capabilities than intended, weakening least-privilege controls and making accidental overreach or data exposure more likely. In a sanitization skill, this is especially relevant because users may provide highly sensitive material for processing.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"Authorization: Bearer super-secret-token",
"OPENAI_API_KEY=sk-examplesecret123456789",
"Contact: dev@example.com",
"url=https://api.example.com/build?token=raw-demo-token&id=42",
"Cookie: sessionid=abc123def456",
"server ip: 10.1.2.3",
"call me at +1 (415) 555-0199",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"Authorization: Bearer super-secret-token",
"OPENAI_API_KEY=sk-examplesecret123456789",
"Contact: dev@example.com",
"url=https://api.example.com/build?token=raw-demo-token&id=42",
"Cookie: sessionid=abc123def456",
"server ip: 10.1.2.3",
"call me at +1 (415) 555-0199",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"Authorization: Bearer super-secret-token",
"OPENAI_API_KEY=sk-examplesecret123456789",
"Contact: dev@example.com",
"url=https://api.example.com/build?token=raw-demo-token&id=42",
"Cookie: sessionid=abc123def456",
"server ip: 10.1.2.3",
"call me at +1 (415) 555-0199",
Detected: suspicious.exposed_secret_literal