pii-scrubber

Scan git diffs and working trees for PII before commits or pushes.

2|Updated May 13, 2026
One-click install
npx skills add https://github.com/alexherrero/crickets --skill pii-scrubber
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: pii-scrubber
Source: https://github.com/alexherrero/crickets/tree/main/src/pii/skills/pii-scrubber
Command: npx skills add https://github.com/alexherrero/crickets --skill pii-scrubber

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Scan the current git diff (or working tree) for personal information — emails, personal paths, API keys, and phone numbers — before commit or push. Surfaces findings as file:line with redaction suggestions and loops until clean, providing an interactive remediation path.

Core Features & Use Cases

  • Detects emails, personal paths, API keys, and phone numbers in diffs and worktrees.
  • Surfaces each finding as a file:line with actionable redaction suggestions and supports a loop until no findings remain.
  • Works across commit and push workflows, integrates with pre-push hooks, and coordinates with a remediation protocol (redact, allowlist, or override).

Quick Start

Run the pii-scrubber before pushing to detect and redact PII in your changes.

Frequently Asked Questions about pii-scrubber

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect and redact PII in git diffs before committing?

Detect and redact PII in git diffs by running a scan before commit or push to identify emails, personal paths, API keys, and phone numbers. It surfaces findings as file:line matches with actionable redaction suggestions, looping until no findings remain.

What types of personal information can a pre-push hook catch in my working tree?

A pre-push hook scan can catch emails, personal paths, API keys, and phone numbers in your working tree. It uses a configurable scan range to identify sensitive data in file changes before you push to a remote repository.

How does PII redaction handle false positives during a git commit workflow?

PII redaction handles false positives during a git commit workflow by offering a remediation protocol that allows you to redact, allowlist, or override findings. Pending findings are persisted in a log to coordinate the resolution process.

Can I scan the entire git working tree instead of just the current diff for sensitive data?

Yes, you can scan the entire git working tree instead of just the current diff. The scan supports configurable scan ranges, allowing you to target the full working tree or limit the scope to staged changes before a commit.

What is the best way to prevent API keys from leaking through git pushes?

The best way to prevent API keys from leaking is to enforce a pre-push hook that scans diffs for sensitive data. It identifies API keys as file:line matches and blocks the push until you redact the finding, add it to an allowlist, or override it.

Do I need to install external dependencies to scan diffs for personal information?

No, you do not need to install external dependencies to scan diffs for personal information. The scan runs using a shell script, requiring no additional packages to identify and redact sensitive data in your local repository.