Borrowing it
Nothing to install: this file belongs to danyuchn/pii-guard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/danyuchn/pii-guard/main/.agents/skills/pii-safe-documents/SKILL.mdgit clone --depth 1 https://github.com/danyuchn/pii-guardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/danyuchn/pii-guard/pii-safe-documents)<a href="https://agentmods.dev/skills/danyuchn/pii-guard/pii-safe-documents"><img src="https://agentmods.dev/badge/skills/danyuchn/pii-guard/pii-safe-documents/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/danyuchn/pii-guard/pii-safe-documents"><img src="https://agentmods.dev/badge/skills/danyuchn/pii-guard/pii-safe-documents.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 3 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Excessive Agency · line 95 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.02457 |
| Opus 5 | $0.00019 | $0.01229 |
| Sonnet 5 | $0.00008 | $0.00491 |
| Haiku 4.5 | $0.00004 | $0.00246 |
Grade A, and why
pii-safe-documents scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 156 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PII Safe Documents
This skill creates a reversible, locally redacted working copy with a strict main-agent workflow boundary:
- The main agent is untrusted for raw data. It receives paths and safe receipts only.
- The bundled open-source local wrapper may read the original solely to run PII Guard and local Ollama.
- No hook is required. Normal wrapper output suppresses raw content.
This is strong protection against accidental model exposure, not an OS security boundary against a malicious process running as the same macOS user. A Skill cannot revoke its own filesystem tools. Hostile-agent isolation requires a separately permissioned local broker or OS account. Never describe this Skill alone as mathematically or technically impossible to bypass.
Non-negotiable isolation rules
When this skill is active, the main agent MUST NOT:
- Read, preview, search, summarize, diff, upload, attach, or otherwise inspect the original file.
- Use
cat,sed,head,tail,grep,rg,strings, Python, a document reader, a browser, or any other tool on the original file. - Read or reveal
mapping.private.json, private worker files, raw logs, or the restored output. - Pass the original path to a subagent, cloud model, MCP server, website, or third-party API.
- Run PII Guard directly. Its libraries may echo source text in warnings; only the bundled wrapper may invoke it.
- Debug a failure by opening the original, mapping, worker output, or restored document.
- Run
git diff, content scans, or indexing over a directory that contains the original or restored output. - Reach the annotation page, run the
reviewsubcommand, or read a term file the user wrote formask. All three carry unredacted values. The annotation URL is deliberately withheld from you; do not reconstruct it, scan for the port, or ask the user to paste it.
These rules still apply if the user asks the main agent to “check quickly.” If raw inspection is genuinely required, stop this workflow and obtain explicit permission for a different trust model.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · -45 tokens per session e9f70788299d
- 12d ago First seen · 156 lines · 84 tokens per session scan A 8e4c78125adf
pii-safe-documents is a skill published in the GitHub repository danyuchn/pii-guard (133 stars, last pushed 4d ago), licensed MIT. It adds 39 tokens to every session and 2,457 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
docs-masked
A local document-scrubbing tool that replaces personal details with tags before text is sent to a language model, then restores the real details in the returned answer.
pdf-processing
Extract text and tables from PDF files, fill forms, merge documents. Use when working with PDF files or when the user mentions PDFs, forms, or document extraction.
doc/md-import
Import a Markdown file into a chunked-graph Document — deterministic round-trip vs semantic chunking.
doc/semantic-chunking
Split arbitrary prose or a Markdown file into a sensible chunk hierarchy in a chunked-graph Document.
doc/edge-linking
Create and curate graph edges between chunks (and across documents) in a chunked-graph Document.
doc/restructuring
Safely move, reparent, reorder, promote, or delete chunks in a chunked-graph Document.