How do I install the Redaction Guard skill?

Run npx skillmds@latest add microsoft/redaction-guard in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Redaction Guard safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Redaction Guard?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Redaction Guard free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Redaction Guard?

Microsoft (@microsoft) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Redaction Guard by microsoft — Agent Skill

Name: Redaction Guard
Rating: 4.2 (5 reviews)
Author: Microsoft

Redaction Guard

Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.

Microsoft Updated Sep 10, 2026 2.7k repo stars

File contents

Zava Learning — Redaction Guard

A cross-cutting safety layer: nothing sensitive ever reaches an operator-visible surface. The triggering alert is symptom-only and the investigation touches Key Vault secrets, connection strings, access tokens and learner PII — none of which may be exposed in chat, notes, PRs, or reports.

Load the standard, then scrub

Retrieve the canonical policy and scrubber with SearchMemory("zava-redaction"). It defines what counts as sensitive, the credential files you must never print, and a deterministic redact() function. Apply redact() (via ExecutePythonCode) to every string you are about to emit — chat summary, note body, PR/commit text, and the assembled HTML/markdown/deck — before it leaves the agent. The scrubber is idempotent, so running it more than once is safe.

What to redact (summary — see `zava-redaction` for the full list)

Secrets & credentials: passwords, PGPASSWORD, connection strings, Key Vault secret values, client secrets, API / access / account keys, SAS tokens.
Tokens: GitHub PATs (gho_/ghp_/github_pat_…), JWTs / AAD access tokens (eyJ…), bearer / Authorization values.
Private keys: any -----BEGIN … PRIVATE KEY----- block, SSH/cert keys.
Credentials inside URIs: the password in scheme://user:password@host.
PII: email addresses and learner personal data from the database.

Keep resource names, resource groups, regions, app names, alert names, and PR/CR numbers — they are not sensitive and are needed for the narrative.

Hard rules

Never read or print credential files. Reference them by name only — never cat / Get-Content / echo / type the contents of .git/git-credentials, .env, *.pem, id_rsa*, *.pfx, kubeconfig, ~/.azure/*, or *.tfstate into the thread or a report.
When a command can echo a secret (e.g. az keyvault secret show), do not paste its output — confirm the fact ("secret present / rotated") without revealing the value.
When in doubt, redact. Replace with [REDACTED:<CLASS>]; for URI credentials keep the scheme and username and mask only the password.

How the other skills use this

zava-reporting, pagerduty-incident-update, servicenow-change-management, and pr-delivery each call redact() on their output before emitting. Because loading a separate skill swaps the active toolset, those skills inline the redact() function (retrieved via SearchMemory("zava-redaction")) within their own ExecutePythonCode step rather than handing off here — this skill is the authoritative definition they follow.

Verification

Every operator-visible string has passed through redact() (or equivalent manual masking) and shows [REDACTED:<CLASS>] in place of any secret, token, private key, URI credential, or PII. No credential file was ever printed to the thread or a deliverable.

---name: redaction-guarddescription: Use whenever you are about to emit operator-visible content — a chat/thread message, a PagerDuty or ServiceNow note, a commit message or pull-request body, or any report artifact (HTML, PowerPoint, Teams card). Deterministically masks secrets, credentials, tokens, private keys, URI-embedded passwords, and PII so they never appear in the thread or in any deliverable. This is a cross-cutting guardrail invoked by the output-producing skills, not a runbook step.---## Zava Learning — Redaction GuardA cross-cutting safety layer: nothing sensitive ever reaches an operator-visible surface. Thetriggering alert is symptom-only and the investigation touches Key Vault secrets, connectionstrings, access tokens and learner PII — none of which may be exposed in chat, notes, PRs, orreports.## Load the standard, then scrubRetrieve the canonical policy and scrubber with `SearchMemory("zava-redaction")`. It defines whatcounts as sensitive, the credential files you must never print, and a deterministic `redact()`function. Apply `redact()` (via `ExecutePythonCode`) to **every** string you are about to emit —chat summary, note body, PR/commit text, and the assembled HTML/markdown/deck — before it leaves theagent. The scrubber is idempotent, so running it more than once is safe.## What to redact (summary — see `zava-redaction` for the full list)- Secrets & credentials: passwords, `PGPASSWORD`, connection strings, Key Vault secret **values**, client secrets, API / access / account keys, SAS tokens.- Tokens: GitHub PATs (`gho_`/`ghp_`/`github_pat_…`), JWTs / AAD access tokens (`eyJ…`), bearer / `Authorization` values.- Private keys: any `-----BEGIN … PRIVATE KEY-----` block, SSH/cert keys.- Credentials inside URIs: the password in `scheme://user:password@host`.- PII: email addresses and learner personal data from the database.Keep resource names, resource groups, regions, app names, alert names, and PR/CR numbers — they arenot sensitive and are needed for the narrative.## Hard rules- **Never read or print credential files.** Reference them by name only — never `cat` / `Get-Content` / `echo` / `type` the contents of `.git/git-credentials`, `.env`, `*.pem`, `id_rsa*`, `*.pfx`, `kubeconfig`, `~/.azure/*`, or `*.tfstate` into the thread or a report.- When a command can echo a secret (e.g. `az keyvault secret show`), do not paste its output — confirm the fact ("secret present / rotated") without revealing the value.- When in doubt, redact. Replace with `[REDACTED:<CLASS>]`; for URI credentials keep the scheme and username and mask only the password.## How the other skills use this`zava-reporting`, `pagerduty-incident-update`, `servicenow-change-management`, and `pr-delivery` eachcall `redact()` on their output before emitting. Because loading a separate skill swaps the activetoolset, those skills inline the `redact()` function (retrieved via `SearchMemory("zava-redaction")`)within their own `ExecutePythonCode` step rather than handing off here — this skill is theauthoritative definition they follow.## VerificationEvery operator-visible string has passed through `redact()` (or equivalent manual masking) and shows`[REDACTED:<CLASS>]` in place of any secret, token, private key, URI credential, or PII. Nocredential file was ever printed to the thread or a deliverable.

Frequently asked questions