agentleFS
Sign inStart free
MicrosoftKnown publishermicrosoft/sre-agent/labs/zava-learning/sre-config/agent-config/skills/redaction-guard/SKILL.md

redaction-guard

Skill187 starsChanged 6 months agoMITView on GitHub

Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.

  • Reads credentials

The file

We split this skill into the rules it gives an agent

4 rules. About 0 are common, 1 is distinctive, and 3 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈1

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 3

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Keep resource names, resource groups, regions, app names, alert names, and PR/CR numbers — they are not sensitive and are needed for the …

    line 35
  2. Very specific:

    When a command can echo a secret (e.g.

    line 42
  3. Very specific:

    When in doubt, redact. Replace with [REDACTED:<CLASS>].

    line 44
  4. Very specific:

    Every operator-visible string has passed through redact() (or equivalent manual masking) and shows [REDACTED:<CLASS>] in place of any …

    line 55

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Zava Learning — Redaction Guard

A cross-cutting safety layer: nothing sensitive ever reaches an operator-visible surface. The triggering alert is symptom-only and the investigation touches Key Vault secrets, connection strings, access tokens and learner PII — none of which may be exposed in chat, notes, PRs, or reports.

Load the standard, then scrub

Retrieve the canonical policy and scrubber with SearchMemory("zava-redaction"). It defines what counts as sensitive, the credential files you must never print, and a deterministic redact() function. Apply redact() (via ExecutePythonCode) to every string you are about to emit — chat summary, note body, PR/commit text, and the assembled HTML/markdown/deck — before it leaves the agent. The scrubber is idempotent, so running it more than once is safe.

What to redact (summary — see zava-redaction for the full list)

  • Secrets & credentials: passwords, PGPASSWORD, connection strings, Key Vault secret values, client secrets, API / access / account keys, SAS tokens.
  • Tokens: GitHub PATs (gho_/ghp_/github_pat_…), JWTs / AAD access tokens (eyJ…), bearer / Authorization values.
  • Private keys: any -----BEGIN … PRIVATE KEY----- block, SSH/cert keys.
  • Credentials inside URIs: the password in scheme://user:password@host.
  • PII: email addresses and learner personal data from the database.

Keep resource names, resource groups, regions, app names, alert names, and PR/CR numbers — they are not sensitive and are needed for the narrative.

Hard rules

  • Never read or print credential files. Reference them by name only — never cat / Get-Content / echo / type the contents of .git/git-credentials, .env, *.pem, id_rsa*, *.pfx, kubeconfig, ~/.azure/*, or *.tfstate into the thread or a report.
  • When a command can echo a secret (e.g. az keyvault secret show), do not paste its output — confirm the fact ("secret present / rotated") without revealing the value.
  • When in doubt, redact. Replace with [REDACTED:<CLASS>]; for URI credentials keep the scheme and username and mask only the password.

How the other skills use this

zava-reporting, pagerduty-incident-update, servicenow-change-management, and pr-delivery each call redact() on their output before emitting. Because loading a separate skill swaps the active toolset, those skills inline the redact() function (retrieved via SearchMemory("zava-redaction")) within their own ExecutePythonCode step rather than handing off here — this skill is the authoritative definition they follow.

Verification

Every operator-visible string has passed through redact() (or equivalent manual masking) and shows [REDACTED:<CLASS>] in place of any secret, token, private key, URI credential, or PII. No credential file was ever printed to the thread or a deliverable.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free