Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add getsentry/warden-skills --skill wrdn-piigit clone --depth 1 https://github.com/getsentry/warden-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/getsentry/warden-skills/wrdn-pii)<a href="https://agentmods.dev/skills/getsentry/warden-skills/wrdn-pii"><img src="https://agentmods.dev/badge/skills/getsentry/warden-skills/wrdn-pii/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/getsentry/warden-skills/wrdn-pii"><img src="https://agentmods.dev/badge/skills/getsentry/warden-skills/wrdn-pii.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00085 | $0.03692 |
| Opus 5 | $0.00043 | $0.01846 |
| Sonnet 5 | $0.00017 | $0.00738 |
| Haiku 4.5 | $0.00009 | $0.00369 |
Grade A, and why
wrdn-pii scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 253 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior application security engineer. You hunt real personal identifiers, customer identifiers, and customer-confidential business data copied into code, durable logs, URLs, telemetry, fixtures, docs, comments, config, or response payloads. These findings look boring until they are in public git history, CDN logs, or a vendor dashboard forever.
This skill is about privacy and customer-data exposure. It is not a generic information-disclosure review. Report only when the changed code introduces or exposes data that can identify a person, identify a specific customer, or reveal non-public business data for a specific customer or production account.
Trace. Do Not Skim.
PII review is context review. A string that looks like an email may be a fake fixture. A harmless-looking org slug may identify a real customer. Prove the identifier is real enough and exposed enough before reporting.
- Read the surrounding file, not just the changed line. File path and test/fixture role decide many cases.
- Identify the data class: real email, person name plus another identifier, phone, address, customer org/account slug, customer revenue/billing/contract data, account usage, support ticket detail, customer-tied internal ID, public routable IP, device ID, cookie ID, session-like identifier, or user/customer payload.
- Identify the exposure sink: source control literal, code comment, docs, test fixture, config, log/exception/analytics/metrics tag, Sentry tag/user context, URL path/query string, redirect, cache key, artifact, export, or API response.
- Follow data flow for runtime values.
user.emailin memory is normal.logger.info(..., extra={"email": user.email}),?email=..., ormetrics.incr(..., tags={"email": email})is a privacy sink. - Verify fake versus real. Do not report vague resemblance. Drop the finding when context proves the value is synthetic, reserved, hashed, redacted, or author metadata.
- Use the shell.
rgfor sibling fixtures, serializers, logging patterns, and allowlisted placeholders.git log -p <file>can show whether a real customer identifier was pasted during debugging.
When a thread cannot be resolved with the available files, report only if the identifier is concrete and the sink is durable. Otherwise drop it. Noise trains people to ignore the one real customer email.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 253 lines · 85 tokens per session scan A d2ef15aff673
wrdn-pii is a skill published in the GitHub repository getsentry/warden-skills (57 stars, last pushed 18d ago), licensed MIT. It adds 85 tokens to every session and 3,692 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
iterate-pr
Iterate on a PR until actionable CI passes and high/medium review feedback is addressed. Use for PR CI failures, review feedback, or green-check loops; do not wait for human approval, draft status, or merge gates.
code-review
Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.
gh-review-requests
Fetch unread GitHub notifications for open PRs where review is requested from a specified team or opened by a team member. Use when asked to "find PRs I need to review", "show my review requests", "what needs my review", "fetch GitHub review requests", or "check team review queue".
code-review
Finds real correctness bugs in code changes. Use for adversarial code review, bug hunts, regression review, PR correctness review, logic errors, data loss, race conditions, state bugs, interface contract breaks, error handling bugs, edge cases, broken builds, or broken workflows. Excludes style, readability…
warden-sweep
Full-repository code sweep. Scans every file with Warden, verifies findings through deep tracing, creates draft PRs for validated issues. Use when asked to "sweep the repo", "scan everything", "find all bugs", "full codebase review", "batch code analysis", or run Warden across the entire repository.
warden
Run Warden to analyze code changes before committing. Use when asked to "run warden", "check my changes", "review before commit", "warden config", "warden.toml", "create a warden skill", "add trigger", or any Warden-related local development task.