@tank/token-redaction

Name: @tank/token-redaction
Availability: InStock
Author: tankpkg

Detect and redact API tokens, keys, bearer values, and JWTs from SQLite session stores.

1|1|Updated Feb 20, 2026

Search Tags:#security #jwt #sqlite #data privacy #api keys #redaction

Ready to run

npx skills add https://github.com/tankpkg/skills --skill tank-token-redaction

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: @tank/token-redaction
Source: https://github.com/tankpkg/skills/tree/main/skills/token-redaction
Command: npx skills add https://github.com/tankpkg/skills --skill tank-token-redaction

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill safeguards your local session data by automatically detecting and redacting sensitive information like API tokens, keys, and JWTs from SQLite databases, preventing accidental leaks.

Core Features & Use Cases

Automated Token Detection: Identifies common token formats (Supabase, GitHub, Slack, OpenAI, JWTs, Bearer tokens) and custom patterns.
Safe Redaction Workflow: Implements a robust backup-first, transactional update, and verification process to ensure data integrity.
Use Case: If you suspect an API key has been inadvertently logged in your OpenCode session store, this skill can securely redact it without compromising your data.

Quick Start

Use the token-redaction skill to perform a dry-run scan of your default OpenCode database.

Frequently Asked Questions about @tank/token-redaction

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I redact API tokens and JWTs from a SQLite session store?▼

To redact API tokens and JWTs from a SQLite session store, you can use an automated detection and redaction tool that identifies sensitive formats and safely removes them. This process implements a backup-first workflow with transactional updates to ensure database integrity.

What types of sensitive data can be detected and redacted from local databases?▼

Sensitive data redaction can detect and remove common token formats including Supabase, GitHub, Slack, and OpenAI API keys, as well as JWTs and Bearer token values stored in local SQLite session databases.

Can I perform a dry-run scan to verify token redaction before modifying the database?▼

Yes, you can perform a dry-run verification to scan for sensitive tokens before modifying anything. This allows you to review detected API keys and JWTs, ensuring pattern matching works correctly before executing transactional database updates.

Does the redaction process include database integrity checks and backup?▼

The redaction process includes a safe workflow that performs database integrity checks alongside a backup-first approach. By using transactional updates and verification, it ensures your SQLite session data remains uncompromised while cleaning up sensitive credentials.

When should I scan my SQLite session store for credential leaks?▼

You should scan for credential leaks when you suspect an API key has been inadvertently logged in your session store, or during security key rotation and routine session cleanup to ensure no sensitive tokens are exposed in your local SQLite database.