How do I install the Pii Scanner skill?

Run npx skillmds@latest add jzills/pii-scanner in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pii Scanner safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pii Scanner?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pii Scanner free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Pii Scanner?

jzills (@jzills) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pii Scanner by jzills — Agent Skill

Name: Pii Scanner
Author: jzills

Pii Scanner

Scans prompts and pasted data for Personally Identifiable Information (PII) and either hard-rejects the request or warns and redacts before continuing. The plugin ships a UserPromptSubmit hook (pii_check.py) that runs automatically on every prompt for regex-detectable PII. This skill handles the Claude-side response when the hook fires, AND deeper semantic scanning for context-dependent PII the regex cannot catch. ALWAYS invoke this skill when: a systemMessage says PII was detected; the user asks to "scan for PII", "check for PII", "redact PII", or "sanitize this"; the user pastes records, CSVs, logs, JSON dumps, or any structured data that could contain personal information; or the task involves processing customer, patient, or employee data. When in doubt, invoke — a false positive is far cheaper than silently processing PII.

jzills 72b17d8 2 files · 6.8 KB Updated Sep 17, 2026

File contents

PII Scanner

The plugin's pii_check.py hook runs before every prompt and handles regex- detectable PII automatically. This skill covers two remaining cases:

Hook fired — the hook injected a systemMessage; follow its instructions.
Direct invocation — the user asked for a PII scan, or you detected a data-heavy context the hook may have missed.

Read references/pii_categories.md for the full PII taxonomy, hook-detected vs. semantic-only types, and false-positive guidance.

When the hook fires (systemMessage present)

The system message will say either:

⛔ SECURITY BLOCK — refuse the request. Do NOT process, summarize, or analyze the prompt. Tell the user what PII types were found (not the values), and ask them to remove the data. Mention the redact: prefix as an option.
⚠️ PII detected and redacted — use only the sanitized prompt between --- SANITIZED PROMPT --- markers. Do NOT reference or repeat the original values. Complete the user's task using the redacted text.

Direct invocation / semantic scan

When the hook did not fire (or the user explicitly asked for a scan), perform a semantic pass on the content:

Step 1 — Detect

Scan the full text using both signals:

Regex patterns — emails, phone numbers, SSNs, card numbers, IPs (see references/pii_categories.md). The hook already caught these if present, but double-check for anything it may have missed.
Semantic patterns — names in data contexts, physical addresses, dates of birth combined with names, medical conditions linked to an individual, driver's licenses, national IDs. These require understanding context: John as a variable is not PII; John Smith, DOB 1985-04-15 in a CSV row is.

If nothing is found, proceed normally. No need to announce a clean result unless the user asked for a scan.

Step 2 — Choose mode

Context	Mode
User says "redact", "sanitize", "clean up", "remove PII"	Redact
User says "scan", "check", "does this have PII?"	Report only
PII found while doing another task (no instruction)	Block

Default to Block when the mode is ambiguous.

Step 3 — Respond

Block:

⛔ PII detected — cannot proceed

Found:
- [type]: [brief location hint, no raw values]

Please remove or anonymize this data and resubmit.
Prefix with 'redact:' to have me replace it with typed placeholders.

Redact:

⚠️  PII redacted before processing

Replacements:
- [TYPE] × N (e.g. "…sent to [EMAIL]…")

Continuing with sanitized content.
---
[sanitized text]

Report only:

PII scan complete

Found:
- [type]: [count] instance(s) — [brief location hint, no raw values]

No processing was done. Remove the listed items before sharing externally.

Config

The hook mode is controlled by ~/.claude/pii-scanner.config.json:

{"mode": "block"}   // hard-reject (default)
{"mode": "warn"}    // redact and continue

The file is auto-created from the plugin default on first run. Edit it to switch modes globally. Use the redact: prompt prefix for a one-off warn mode override.

---name: pii-scannerdescription: Scans prompts and pasted data for Personally Identifiable Information (PII) and either hard-rejects the request or warns and redacts before continuing. The plugin ships a UserPromptSubmit hook (pii_check.py) that runs automatically on every prompt for regex-detectable PII. This skill handles the Claude-side response when the hook fires, AND deeper semantic scanning for context-dependent PII the regex cannot catch. ALWAYS invoke this skill when: a systemMessage says PII was detected; the user asks to "scan for PII", "check for PII", "redact PII", or "sanitize this"; the user pastes records, CSVs, logs, JSON dumps, or any structured data that could contain personal information; or the task involves processing customer, patient, or employee data. When in doubt, invoke — a false positive is far cheaper than silently processing PII.---# PII ScannerThe plugin's `pii_check.py` hook runs before every prompt and handles regex-detectable PII automatically. This skill covers two remaining cases:1. **Hook fired** — the hook injected a `systemMessage`; follow its instructions.2. **Direct invocation** — the user asked for a PII scan, or you detected a data-heavy context the hook may have missed.Read `references/pii_categories.md` for the full PII taxonomy, hook-detected vs.semantic-only types, and false-positive guidance.---## When the hook fires (systemMessage present)The system message will say either:- **`⛔ SECURITY BLOCK`** — refuse the request. Do NOT process, summarize, or analyze the prompt. Tell the user what PII *types* were found (not the values), and ask them to remove the data. Mention the `redact:` prefix as an option.- **`⚠️ PII detected and redacted`** — use only the sanitized prompt between `--- SANITIZED PROMPT ---` markers. Do NOT reference or repeat the original values. Complete the user's task using the redacted text.---## Direct invocation / semantic scanWhen the hook did not fire (or the user explicitly asked for a scan), perform asemantic pass on the content:### Step 1 — DetectScan the full text using both signals:- **Regex patterns** — emails, phone numbers, SSNs, card numbers, IPs (see `references/pii_categories.md`). The hook already caught these if present, but double-check for anything it may have missed.- **Semantic patterns** — names in data contexts, physical addresses, dates of birth combined with names, medical conditions linked to an individual, driver's licenses, national IDs. These require understanding context: `John` as a variable is not PII; `John Smith, DOB 1985-04-15` in a CSV row is.If nothing is found, proceed normally. No need to announce a clean result unlessthe user asked for a scan.### Step 2 — Choose mode| Context | Mode ||---------|------|| User says "redact", "sanitize", "clean up", "remove PII" | **Redact** || User says "scan", "check", "does this have PII?" | **Report only** || PII found while doing another task (no instruction) | **Block** |Default to **Block** when the mode is ambiguous.### Step 3 — Respond**Block:**```⛔ PII detected — cannot proceedFound:- [type]: [brief location hint, no raw values]Please remove or anonymize this data and resubmit.Prefix with 'redact:' to have me replace it with typed placeholders.```**Redact:**```⚠️ PII redacted before processingReplacements:- [TYPE] × N (e.g. "…sent to [EMAIL]…")Continuing with sanitized content.---[sanitized text]```**Report only:**```PII scan completeFound:- [type]: [count] instance(s) — [brief location hint, no raw values]No processing was done. Remove the listed items before sharing externally.```---## ConfigThe hook mode is controlled by `~/.claude/pii-scanner.config.json`:```json{"mode": "block"} // hard-reject (default){"mode": "warn"} // redact and continue```The file is auto-created from the plugin default on first run. Edit it to switchmodes globally. Use the `redact:` prompt prefix for a one-off warn mode override.

Frequently asked questions