doc-redactor

Name: doc-redactor
Author: girijashankarj

27stars3forks

How to install doc-redactor?

girijashankarj/cursor-handbook/doc-redactor

$npx -y skills add girijashankarj/cursor-handbook --skill doc-redactor

Installs into the current project.

Summary

Scan and redact sensitive information (secrets, PII, internal URLs, credentials) from documents, configs, logs, and code. Use when the user asks to sanitize files, redact secrets, or prepare content for sharing.

Files · 1

View on GitHub

SKILL.md

1	# Skill: Doc Redactor
2
3	Systematically scan and redact sensitive information from files before sharing, committing, or publishing.
4
5	## Trigger
6	When the user asks to redact, sanitize, or clean sensitive data from files — or before sharing code/docs externally.
7
8	## Prerequisites
9	- [ ] Files or content to redact identified
10	- [ ] Sensitivity classification understood (what must be redacted)
11
12	## Steps
13
14	### Step 1: Identify Redaction Targets
15
16	\| Category \| Examples \| Replacement Pattern \|
17	\|----------\|---------\|-------------------\|
18	\| API Keys \| `sk-...`, `AKIA...`, `ghp_...` \| `[API_KEY]` \|
19	\| Passwords \| Password values, connection strings \| `[PASSWORD]` \|
20	\| Tokens \| JWT, OAuth, bearer tokens \| `[TOKEN]` \|
21	\| URLs \| Internal endpoints, admin panels \| `[INTERNAL_URL]` \|
22	\| IPs \| Server IPs, private ranges \| `[IP_ADDRESS]` \|
23	\| Emails \| Personal or corporate email addresses \| `[EMAIL]` \|
24	\| Names \| Personal names in logs or comments \| `[PERSON_NAME]` \|
25	\| Phone Numbers \| Any phone format \| `[PHONE]` \|
26	\| Account IDs \| AWS account IDs, GCP project IDs \| `[ACCOUNT_ID]` \|
27	\| Resource ARNs \| `arn:aws:...` \| `[RESOURCE_ARN]` \|
28	\| Database Hosts \| RDS endpoints, MongoDB URIs \| `[DB_HOST]` \|
29	\| S3 Buckets \| `s3://bucket-name` \| `[BUCKET_NAME]` \|
30	\| Queue Names \| SQS, RabbitMQ, Kafka topic names \| `[QUEUE_NAME]` \|
31	\| Certificates \| PEM blocks, cert contents \| `[CERTIFICATE]` \|
32	\| SSN / Tax IDs \| Social security, EIN numbers \| `[REDACTED_ID]` \|
33	\| Credit Cards \| Card numbers, CVVs \| `[CARD_NUMBER]` \|
34
35	### Step 2: Scan Files
36	- [ ] Search for common secret patterns using regex:
37
38	```
39	# API keys and tokens
40	/(?:api[_-]?key\|token\|secret\|password\|credential)\s[:=]\s["']?[A-Za-z0-9+/=_-]{16,}/gi
41
42	# AWS keys
43	/AKIA[0-9A-Z]{16}/g
44
45	# GitHub tokens
46	/gh[pousr]_[A-Za-z0-9_]{36,}/g
47
48	# JWT tokens
49	/eyJ[A-Za-z0-9_-]\.eyJ[A-Za-z0-9_-]\.[A-Za-z0-9_-]*/g
50
51	# Connection strings
52	/(?:mongodb\|postgres\|mysql\|redis):\/\/[^\s"']+/gi
53
54	# IP addresses (private ranges)
55	/(?:10\|172\.(?:1[6-9]\|2\d\|3[01])\|192\.168)\.\d{1,3}\.\d{1,3}/g
56
57	# Email addresses
58	/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g
59
60	# AWS ARNs
61	/arn:aws:[a-z0-9-]+:[a-z0-9-]:\d{12}:[^\s"']/g
62
63	# AWS Account IDs (12-digit)
64	/\b\d{12}\b/g (context-dependent)
65
66	# PEM certificates
67	/-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----/g
68	```
69
70	### Step 3: Classify Findings
71	For each match:
72	- [ ] Determine if it's a true positive (actual secret) or false positive
73	- [ ] Classify sensitivity level: Restricted (must redact) vs Internal (should redact)
74	- [ ] Group findings by file and type
75	- [ ] Present a summary to the user before redacting
76
77	### Step 4: Apply Redactions
78	- [ ] Replace each finding with the appropriate placeholder from Step 1
79	- [ ] Preserve file structure and formatting
80	- [ ] Keep enough context for the document to remain useful
81	- [ ] For `.env` files: keep keys, redact values → `DB_PASSWORD=[PASSWORD]`
82	- [ ] For logs: mask inline → `email: "j***@example.com"`
83	- [ ] For code: replace with env var references → `process.env.API_KEY`
84
85	### Step 5: Handle Special Cases
86
87	#### `.env` Files
88	```bash
89	# Before
90	DB_PASSWORD=super_secret_password_123
91	API_KEY=sk-1234567890abcdef
92
93	# After
94	DB_PASSWORD=[PASSWORD]
95	API_KEY=[API_KEY]
96	```
97
98	#### Configuration Files
99	```json
100	// Before
101	{ "host": "prod-db-cluster.abc123.us-east-1.rds.amazonaws.com" }
102
103	// After
104	{ "host": "[DB_HOST]" }
105	```
106
107	#### Log Files
108	```
109	// Before
110	User john.doe@company.com placed order from 10.0.1.45
111
112	// After
113	User [EMAIL] placed order from [IP_ADDRESS]
114	```
115
116	#### Code Comments
117	```typescript
118	// Before
119	// Contact admin@internal-corp.com for access to prod-api.internal.company.com
120
121	// After
122	// Contact [EMAIL] for access to [INTERNAL_URL]
123	```
124
125	### Step 6: Generate Redaction Report
126	- [ ] List all files scanned
127	- [ ] Count of findings per category
128	- [ ] List of redactions applied (without showing the original values)
129	- [ ] Flag any uncertain findings for manual review
130
131	```markdown
132	## Redaction Report
133	- Files scanned: 12
134	- Findings: 23
135	- API Keys: 3
136	- Emails: 8
137	- Internal URLs: 5
138	- IP Addresses: 4
139	- Database hosts: 3
140	- Redactions applied: 21
141	- Needs manual review: 2 (possible false positives flagged in output)
142	```
143
144	### Step 7: Validate
145	- [ ] Re-scan redacted files to confirm no remaining secrets
146	- [ ] Verify the document is still readable and useful
147	- [ ] Check that placeholders are consistent (same secret → same placeholder)
148
149	## Rules
150	- NEVER show or log the original secret values in output
151	- ALWAYS err on the side of redacting (false positive > missed secret)
152	- ALWAYS generate a redaction report
153	- NEVER modify files without user confirmation
154	- Preserve document structure — only replace the sensitive valu

People who liked this also viewed

6 picks

Type

doc-redactor

27stars3forks

View on GitHub

How to install doc-redactor?

girijashankarj/cursor-handbook/doc-redactor

$npx -y skills add girijashankarj/cursor-handbook --skill doc-redactor

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Skill: Doc Redactor
2
3	Systematically scan and redact sensitive information from files before sharing, committing, or publishing.
4
5	## Trigger
6	When the user asks to redact, sanitize, or clean sensitive data from files — or before sharing code/docs externally.
7
8	## Prerequisites
9	- [ ] Files or content to redact identified
10	- [ ] Sensitivity classification understood (what must be redacted)
11
12	## Steps
13
14	### Step 1: Identify Redaction Targets
15
16	\| Category \| Examples \| Replacement Pattern \|
17	\|----------\|---------\|-------------------\|
18	\| API Keys \| `sk-...`, `AKIA...`, `ghp_...` \| `[API_KEY]` \|
19	\| Passwords \| Password values, connection strings \| `[PASSWORD]` \|
20	\| Tokens \| JWT, OAuth, bearer tokens \| `[TOKEN]` \|
21	\| URLs \| Internal endpoints, admin panels \| `[INTERNAL_URL]` \|
22	\| IPs \| Server IPs, private ranges \| `[IP_ADDRESS]` \|
23	\| Emails \| Personal or corporate email addresses \| `[EMAIL]` \|
24	\| Names \| Personal names in logs or comments \| `[PERSON_NAME]` \|
25	\| Phone Numbers \| Any phone format \| `[PHONE]` \|
26	\| Account IDs \| AWS account IDs, GCP project IDs \| `[ACCOUNT_ID]` \|
27	\| Resource ARNs \| `arn:aws:...` \| `[RESOURCE_ARN]` \|
28	\| Database Hosts \| RDS endpoints, MongoDB URIs \| `[DB_HOST]` \|
29	\| S3 Buckets \| `s3://bucket-name` \| `[BUCKET_NAME]` \|
30	\| Queue Names \| SQS, RabbitMQ, Kafka topic names \| `[QUEUE_NAME]` \|
31	\| Certificates \| PEM blocks, cert contents \| `[CERTIFICATE]` \|
32	\| SSN / Tax IDs \| Social security, EIN numbers \| `[REDACTED_ID]` \|
33	\| Credit Cards \| Card numbers, CVVs \| `[CARD_NUMBER]` \|
34
35	### Step 2: Scan Files
36	- [ ] Search for common secret patterns using regex:
37
38	```
39	# API keys and tokens
40	/(?:api[_-]?key\|token\|secret\|password\|credential)\s[:=]\s["']?[A-Za-z0-9+/=_-]{16,}/gi
41
42	# AWS keys
43	/AKIA[0-9A-Z]{16}/g
44
45	# GitHub tokens
46	/gh[pousr]_[A-Za-z0-9_]{36,}/g
47
48	# JWT tokens
49	/eyJ[A-Za-z0-9_-]\.eyJ[A-Za-z0-9_-]\.[A-Za-z0-9_-]*/g
50
51	# Connection strings
52	/(?:mongodb\|postgres\|mysql\|redis):\/\/[^\s"']+/gi
53
54	# IP addresses (private ranges)
55	/(?:10\|172\.(?:1[6-9]\|2\d\|3[01])\|192\.168)\.\d{1,3}\.\d{1,3}/g
56
57	# Email addresses
58	/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g
59
60	# AWS ARNs
61	/arn:aws:[a-z0-9-]+:[a-z0-9-]:\d{12}:[^\s"']/g
62
63	# AWS Account IDs (12-digit)
64	/\b\d{12}\b/g (context-dependent)
65
66	# PEM certificates
67	/-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----/g
68	```
69
70	### Step 3: Classify Findings
71	For each match:
72	- [ ] Determine if it's a true positive (actual secret) or false positive
73	- [ ] Classify sensitivity level: Restricted (must redact) vs Internal (should redact)
74	- [ ] Group findings by file and type
75	- [ ] Present a summary to the user before redacting
76
77	### Step 4: Apply Redactions
78	- [ ] Replace each finding with the appropriate placeholder from Step 1
79	- [ ] Preserve file structure and formatting
80	- [ ] Keep enough context for the document to remain useful
81	- [ ] For `.env` files: keep keys, redact values → `DB_PASSWORD=[PASSWORD]`
82	- [ ] For logs: mask inline → `email: "j***@example.com"`
83	- [ ] For code: replace with env var references → `process.env.API_KEY`
84
85	### Step 5: Handle Special Cases
86
87	#### `.env` Files
88	```bash
89	# Before
90	DB_PASSWORD=super_secret_password_123
91	API_KEY=sk-1234567890abcdef
92
93	# After
94	DB_PASSWORD=[PASSWORD]
95	API_KEY=[API_KEY]
96	```
97
98	#### Configuration Files
99	```json
100	// Before
101	{ "host": "prod-db-cluster.abc123.us-east-1.rds.amazonaws.com" }
102
103	// After
104	{ "host": "[DB_HOST]" }
105	```
106
107	#### Log Files
108	```
109	// Before
110	User john.doe@company.com placed order from 10.0.1.45
111
112	// After
113	User [EMAIL] placed order from [IP_ADDRESS]
114	```
115
116	#### Code Comments
117	```typescript
118	// Before
119	// Contact admin@internal-corp.com for access to prod-api.internal.company.com
120
121	// After
122	// Contact [EMAIL] for access to [INTERNAL_URL]
123	```
124
125	### Step 6: Generate Redaction Report
126	- [ ] List all files scanned
127	- [ ] Count of findings per category
128	- [ ] List of redactions applied (without showing the original values)
129	- [ ] Flag any uncertain findings for manual review
130
131	```markdown
132	## Redaction Report
133	- Files scanned: 12
134	- Findings: 23
135	- API Keys: 3
136	- Emails: 8
137	- Internal URLs: 5
138	- IP Addresses: 4
139	- Database hosts: 3
140	- Redactions applied: 21
141	- Needs manual review: 2 (possible false positives flagged in output)
142	```
143
144	### Step 7: Validate
145	- [ ] Re-scan redacted files to confirm no remaining secrets
146	- [ ] Verify the document is still readable and useful
147	- [ ] Check that placeholders are consistent (same secret → same placeholder)
148
149	## Rules
150	- NEVER show or log the original secret values in output
151	- ALWAYS err on the side of redacting (false positive > missed secret)
152	- ALWAYS generate a redaction report
153	- NEVER modify files without user confirmation
154	- Preserve document structure — only replace the sensitive valu

People who liked this also viewed

6 picks

Type