How do I install the Sensitive Data skill?

Run npx skillmds@latest add griddynamics/sensitive-data-4 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sensitive Data safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sensitive Data?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sensitive Data free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sensitive Data?

griddynamics (@griddynamics) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sensitive Data by griddynamics — Agent Skill

Name: Sensitive Data
Author: griddynamics

Sensitive Data

MUST activate when you suspect, there is a slight chance, encounter, read, process, or are about to output any sensitive or possibly sensitive data including PII, PCI, HIPAA, PHI, GDPR, SOC2, FedRAMP, secrets, API keys, passwords, credentials, tokens, certificates, or any sensitive data. Follow compliance/regulations.

griddynamics Updated Sep 21, 2026

File contents

DO NOT read, query, store, tell, write, log, or distribute any SENSITIVE information (PII, PCI, HIPAA, PHI, GDPR, SOC2, FedRAMP, Secrets, etc)
IF encountered - report without exposing raw value
IF needed as-is - MUST ask explicit user approval first
User may override (mocked data)
NEVER output, echo, print, log, summarize, or reference the raw value of any sensitive data in chat or in any file
MASK immediately using [REDACTED:<type>] (e.g. [REDACTED:API_KEY], [REDACTED:PASSWORD])
Scan information of your output or artifacts for: Bearer , Authorization:, password:, api_key=, client_secret, eyJ (JWT), AKIA (AWS key), ghp_/gho_/github_pat_ (GitHub), xox[baprs]- (Slack), BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY, BEGIN OPENSSH PRIVATE KEY, postgresql://user:pass@, mongodb+srv://user:pass@; plus emails outside example.com/example.org, phones outside the +1-555-01xx reserved range, card-number shapes \d{4}[\s\-]\d{4}[\s\-]\d{4}[\s\-]\d{4}, and real customer names alongside any of the above. This list is a non-exhaustive floor -- redact any secret-shaped token even if unlisted. Fail-closed -- if the scan cannot run, do not emit
Use IETF reserved ranges for PII placeholders: emails test.user-1@example.com; phones +1-555-0100–+1-555-0199; official PSP test cards (cite source)

DO NOT read, query, store, tell, write, log, or distribute any SENSITIVE information
Identify and apply respective guidance for handling data like that
Guide user for correct implementation

Echoing secrets in summaries or diffs.
Logging sensitive data to AGENT MEMORY.md.

---name: sensitive-data-4description: MUST activate when you suspect, there is a slight chance, encounter, read, process, or are about to output any sensitive or possibly sensitive data including PII, PCI, HIPAA, PHI, GDPR, SOC2, FedRAMP, secrets, API keys, passwords, credentials, tokens, certificates, or any sensitive data. Follow compliance/regulations.---<sensitive_data><process>1. DO NOT read, query, store, tell, write, log, or distribute any SENSITIVE information (PII, PCI, HIPAA, PHI, GDPR, SOC2, FedRAMP, Secrets, etc)2. IF encountered - report without exposing raw value3. IF needed as-is - MUST ask explicit user approval first4. User may override (mocked data)5. NEVER output, echo, print, log, summarize, or reference the raw value of any sensitive data in chat or in any file6. MASK immediately using `[REDACTED:<type>]` (e.g. `[REDACTED:API_KEY]`, `[REDACTED:PASSWORD]`)7. Scan information of your output or artifacts for: `Bearer `, `Authorization:`, `password:`, `api_key=`, `client_secret`, `eyJ` (JWT), `AKIA` (AWS key), `ghp_`/`gho_`/`github_pat_` (GitHub), `xox[baprs]-` (Slack), `BEGIN PRIVATE KEY`, `BEGIN RSA PRIVATE KEY`, `BEGIN OPENSSH PRIVATE KEY`, `postgresql://user:pass@`, `mongodb+srv://user:pass@`; plus emails outside `example.com`/`example.org`, phones outside the `+1-555-01xx` reserved range, card-number shapes `\d{4}[\s\-]\d{4}[\s\-]\d{4}[\s\-]\d{4}`, and real customer names alongside any of the above. This list is a **non-exhaustive floor** -- redact any secret-shaped token even if unlisted. Fail-closed -- if the scan cannot run, do not emit8. Use IETF reserved ranges for PII placeholders: emails `test.user-1@example.com`; phones `+1-555-0100`–`+1-555-0199`; official PSP test cards (cite source)</process><coding>- DO NOT read, query, store, tell, write, log, or distribute any SENSITIVE information- Identify and apply respective guidance for handling data like that- Guide user for correct implementation </coding><pitfalls>- Echoing secrets in summaries or diffs.- Logging sensitive data to AGENT MEMORY.md.</pitfalls></sensitive_data>

Frequently asked questions