RedactKit - AI Privacy Scrubber

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:01 PM UTC
• Version: 1.0.1

Overview

This is a local reversible redaction tool, but verified redaction bugs and sensitive plaintext mapping/report behavior make it risky to trust for privacy protection without review.

Review this skill before installing for any real sensitive data. Reversible redaction is disclosed, but mapping files are effectively secret vaults in plaintext; store them outside shared, synced, or source-controlled folders and protect or encrypt them. Do not rely on this version as a complete scrubber because verified bugs can leave phone numbers and standalone tokens exposed, and avoid report mode in logged environments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: redact_patterns.py:96

Finding

Generic API keys may remain exposed because unmatched capture groups produce invalid replacement boundaries

Content

View full analysis

Remediation

View remediation

= 0`, `end >= start`, and `value is not None` before creating a `RedactionMatch`. Fail closed if these invariants are violated. - Separate generic and labeled API-key detection into distinct `RedactionPattern` objects if their match semantics differ. - Add regression tests for both alternatives, including standalone long tokens, labeled tokens, quoted values, and report mode. - Verify that the original credential is absent from `redacted_text`, not merely that a match object was produced. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: redact_patterns.py:42

Finding

Phone-number redaction replaces only the first captured component

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: redact_kit.py:176

Finding

Restoration mappings containing original secrets are written as plaintext with process-default permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: redact_kit.py:415

Finding

Report mode prints detected credentials and personal data to standard error

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented purpose emphasizes safe local redaction before sending content to AI, but the described behavior also includes restoration of original sensitive values from local mapping files, which is a separate high-risk capability. This mismatch is dangerous because users may trust the skill as a one-way privacy scrubber while it actually preserves and later re-injects secrets, increasing the chance of accidental disclosure or unsafe downstream handling.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · LIMITATIONS.md (reported line 60)May include surrounding context.

md

**Workaround:** 
- Store mapping files in encrypted folders (FileVault, BitLocker, LUKS)
- Manually encrypt JSON files (GPG, openssl)
- Restrict filesystem permissions (chmod 600)

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promotes reversible redaction and quickly introduces mapping files that preserve the original secrets, but the core usage flow does not foreground that these mapping files are themselves highly sensitive artifacts. Users may treat the redacted output as safe while accidentally storing, syncing, or sharing the mapping file, which completely defeats the privacy goal and can re-expose all redacted data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill demonstrates file read/write capability by saving and loading redaction mappings, but it does not declare any tool scope or permissions. Undeclared file access is risky because it obscures the skill's actual capabilities from reviewers and users, especially when the files contain sensitive originals needed for restoration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to save a mapping file that links placeholders back to original sensitive values, but it provides no warning that this file effectively contains the secrets and PII in recoverable form. If that file is left unprotected, copied, logged, committed, or read by another process, the redaction is undermined and sensitive data can be fully exposed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The engine stores reversible mappings of redacted content in process memory, and each mapping contains the original sensitive values. In a privacy-scrubbing tool, this materially increases exposure because secrets and PII remain accessible after redaction and may be disclosed through crashes, debugging, memory inspection, or later persistence to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The mapping file serializes original sensitive values directly to disk, creating a concentrated plaintext record of secrets and PII. In the context of a privacy scrubber, this is especially dangerous because users may assume the tool reduces exposure, while the optional restoration feature can instead create a new high-value artifact that is easier to steal than the original distributed data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI displays matched sensitive substrings directly to stdout, which can re-expose the very secrets or PII the tool is meant to help identify. In shell histories, terminal logs, CI logs, screen recordings, or shared consoles, this behavior can leak credentials and personal data beyond the original input context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a privacy scrubber that scans data and redacts PII, secrets, and sensitive information locally. This file implements the inverse capability: loading stored original values from mapping files and restoring redacted content back to its sensitive form, including batch restoration of directories. That restoration behavior is not reflected in the manifest's stated scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A privacy scrubber's stated purpose is to reduce exposure of sensitive data before sending it to AI. The ability to restore whole files and directories to their original sensitive contents creates a data-recovery capability that is qualitatively different from scanning/redacting and is not explicitly justified by the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The tool restores sensitive values and writes them to plaintext output files without any explicit warning, confirmation, or safety controls. In a privacy-focused skill, this can cause users to unintentionally re-materialize secrets, PII, or credentials on disk, increasing the chance of accidental disclosure through backups, shared directories, logs, or later AI uploads.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 392)May include surrounding context.

md

**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Line L097 states offset tracks position changes from replacements, implying match coordinates are adjusted as text is modified. In reality, offset remains zero throughout, and replacements are instead made safely by sorting matches in reverse order, so the comment/documented intent contradicts the actual implementation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

In single-file mode, the tool defaults to writing a new file using the input path plus '.redacted', and batch mode defaults to writing output unless report mode is enabled. While file-writing is part of the tool's purpose, the invocation path lacks a clear confirmation or prominent warning that execution will create output artifacts and possibly mapping files.

Content

No source excerpt is available for this finding.