pii-scrub

pii-scrub

A Claude Code skill for sanitizing files before external sharing — bug reports, GitHub issues, support tickets, log dumps, screenshots-with-paths, any public artifact.

Pattern-based regex substitution plus user-supplied context tokens (username, hostname, employer, infrastructure terms, internal tool names) with mandatory audit and re-audit passes. By design: regex + operator-supplied tokens, no NER, no ML.

Install as a Claude Code plugin

/plugin marketplace add 6a6f686e6e79/pii-scrub-skill

Then in any Claude Code session:

You: I'm about to upload this zip to a public tracker, scrub it for PII first.
Claude: [invokes pii-scrub skill]

The skill description includes trigger phrases like scrub, sanitize, redact, anonymize, is this safe to send/upload/post? — Claude should pick it up automatically when those come up.

Invoke the scripts directly

If you'd rather skip the skill layer and just use the scripts:

PowerShell 7+ (Windows):

& "<this repo>\skills\pii-scrub\scripts\scrub.ps1" `
    -Files @('C:\path\to\file1.log','C:\path\to\file2.txt') `
    -Substitutions @{
        'alice'    = '<user>'
        'lab-host' = '<hostname>'
        'acmecorp' = '<employer>'
    }

Python 3.8+ (Linux/macOS/Windows):

python3 <this repo>/skills/pii-scrub/scripts/scrub.py \
    --files /path/to/file1.log /path/to/file2.txt \
    --sub 'alice=<user>' --sub 'lab-host=<hostname>' --sub 'acmecorp=<employer>'

Audit only (no substitution, just report what's there):

& "<this repo>\skills\pii-scrub\scripts\scrub.ps1" -Files $files -AuditOnly

What it covers

Pattern	Replacement
Full UUID (8-4-4-4-12 hex)	<session-id>
IPv4	<ip>
IPv6 (strict + compressed)	<ipv6>
Email	<email>
JWT, Anthropic / OpenAI / GitHub / AWS keys	<credential>
Generic (api_key|access_token|secret|bearer|password)=value	<key>=<credential>
US phone, SSN, credit card	<phone> / <ssn> / <credit-card>
Audit-only (flagged, not substituted):
PEM private key markers	(flag, do not share)
Long base64 blobs	(flag for human review)

Credential-shaped patterns all redact to <credential> (not <api-key> / <github-token> / etc.) to avoid leaking which TYPE of credential was in the source — credential type is itself metadata that narrows attack surface.

What it does NOT do

By design, this is regex + operator-supplied tokens. Out of scope:

• No named-entity recognition. "Sarah from legal" won't be redacted unless sarah is in the context tokens.
• No ML / contextual classification.
• No reverse translation (substitution is one-way; keep an unscrubbed copy if needed).
• No file-format awareness (treats all files as text; will redact patterns inside JSON keys, comments, base64 blobs, etc.).
• No transport / encryption.

The skill prompts the user to skim the largest output files before sharing — pattern matching is necessary but not sufficient for identifying-but-not-pattern-matching free-form text.

Repository layout

.claude-plugin/
└── marketplace.json       # Claude Code plugin manifest
skills/
└── pii-scrub/
    ├── LICENSE.txt        # Apache 2.0
    ├── SKILL.md           # full procedure, gotchas, invocation examples
    └── scripts/
        ├── scrub.ps1      # PowerShell 7+ engine
        ├── scrub.py       # Python 3.8+ engine (cross-platform)
        └── patterns.json  # baseline regex pattern library
tests/
└── test-suite.ps1         # cross-engine test of PS1 + Py

Running the tests

PowerShell 7+ and (optionally) Python 3.8+ on PATH:

& .\tests\test-suite.ps1

Expected: all tests passing on both engines.

Design notes

Patterns and gotchas (strict-IPv6 to avoid timestamp false positives; word-boundary substitution to avoid substring damage; filename audit; manual-skim backstop) come from real failures while scrubbing real artifacts. Each "lesson" in skills/pii-scrub/SKILL.md reflects a class of mistake observed in practice.

License

Apache 2.0. See skills/pii-scrub/LICENSE.txt.

Contributing

Issues and PRs welcome. For new pattern additions, please include:

1. A test case in tests/test-suite.ps1
2. A note in skills/pii-scrub/SKILL.md's "default substitution placeholders" table
3. A $comment field in patterns.json explaining edge cases / known false-positives

The skill is also being prepared as a PR to anthropics/skills. If you'd like to use the canonical skills/pii-scrub/ subtree there (when/if accepted), this repo continues to serve as the development upstream.