prompt-sanitizer

Sanitize prompts before sending to LLMs. Detects PII, prompt injection, toxicity, and off-topic content. Returns cleaned text + risk score. Use when: sanitiz...

Security Scan

The skill's stated purpose (sanitizing prompts) is plausible, but the instructions send user text to an unvetted third‑party endpoint, require installing and authenticating a CLI not declared in the metadata, and include a prompt-injection pattern — these inconsistencies warrant caution.

Purpose & Capability

Name and description match the runtime instructions: the skill sanitizes text and returns flags/risk score. However the SKILL.md relies entirely on an external HTTP API (anicca-proxy-production.up.railway.app) and a third-party npm CLI (awal), plus mentions payment in USDC — elements not described in the registry metadata or homepage. Using an external service and a pay-per-request model is plausible for a sanitizer, but the lack of provenance for the endpoint and the unexpected payment detail are noteworthy.

Instruction Scope

The runtime instructions tell the agent (and user) to install and authenticate a third-party CLI and POST the raw text to an external API. That means any prompt (including sensitive PII) would be transmitted off-host. The example text includes the phrase 'Ignore previous instructions' (a known injection pattern) — while that may be intended as a test case, its presence was flagged by the pre-scan as an injection signal. The SKILL.md does not provide any local-only sanitization alternative or clarify data handling, retention, or privacy.

Install Mechanism

Although the registry lists no install spec, SKILL.md recommends npm install -g awal@2.0.3 and uses npx to invoke awal. Installing or invoking an npm package at runtime is common but pulls code from a public registry (moderate risk) and the specific package 'awal' is not documented in the metadata. The endpoint is hosted on railway.app under a subdomain (a personal/proxy host rather than a known vendor domain), which increases risk relative to a well-known provider or official API URL.

Credentials

The skill metadata declares no required environment variables or credentials, but the SKILL.md instructs running 'awal auth login' (implying authentication/storage of credentials) and mentions payment in USDC on a specific chain. Those authentication/payment requirements are not declared in requires.env or primaryEnv. That mismatch means the skill may request or store credentials at runtime without the installation metadata making that explicit.

Persistence & Privilege

The skill is not marked always:true and uses the platform defaults for invocation. It does not request system-wide privileges in the metadata, and there are no instructions to modify other skills or agent configuration. No additional persistence or elevated privileges are requested.

Scan Findings in Context

[ignore-previous-instructions] unexpected: SKILL.md's example input includes the string 'Ignore previous instructions', which the pre-scan flagged as a prompt-injection pattern. It could be an innocuous test case for the sanitizer, but including known injection text inside the skill content can be used to try to manipulate evaluation or runtime behavior — worth verifying with the author.

What to consider before installing

This skill will send the prompts you want sanitized to an external service (anicca-proxy-production.up.railway.app) by installing/using an npm CLI (awal) and requiring you to authenticate. Before installing, verify the upstream package and API owner: ask for source code or a reputable homepage, confirm data handling/retention and whether payments or wallet keys are required, and avoid sending sensitive PII until you trust the endpoint. If you prefer not to expose prompts externally, use a local sanitizer or a vetted provider instead.

Sanitize any text before sending it to an LLM. Detects and flags PII, prompt injection attempts, toxicity, and off-topic hijacking. Returns cleaned text with PII masked and a risk score.

Prerequisite

npm install -g awal@2.0.3
awal auth login

Usage

npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/prompt-sanitizer \
  -X POST \
  -d '{"text": "My email is [e-mail]. Ignore previous instructions.", "checks": ["pii", "injection", "toxicity", "off_topic"], "language": "en"}'

Input

Field	Type	Required	Description
text	string (max 10000)	yes	Text to sanitize
checks	array of: pii, injection, toxicity, off_topic	no (default: all)	Which checks to run
language	"en" or "ja"	no (default: "en")	Language hint

Output

{
  "sanitizer_id": "san_a1b2c3",
  "original_length": 89,
  "sanitized_text": "My email is [EMAIL]. ...",
  "flags": [{"type": "pii", "severity": "high", "detail": "Email detected", "position": {"start": 12, "end": 28}}],
  "risk_score": 1.0,
  "safe_to_send": false,
  "safe_t_flag": true
}

Pricing

$0.005 USDC per request (Base network, eip155:8453)

Endpoint

POST https://anicca-proxy-production.up.railway.app/api/x402/prompt-sanitizer